Is itCheck something

php2shell No. CVE-2026-109619

Hackers can take over websites running PHP without a login

Being used now

Yes. Attackers are using this right now.

Anyone running a website on PHP, including most WordPress hosting.

What to do

Update PHP to the latest version, or ask your web host to do it.

Confirmed in attacks
Oct 26, 2026
Product
PHP
GitHub repos
58
Social interactions today
638K
Attack likelihood, next 30 days
over 99%

Attack likelihood is EPSS, a daily estimate from FIRST.org of how likely this bug is to be used in attacks in the next 30 days.

Part of the same attack (php2shell)

The official description

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

What people are saying

Social attention, not a count of victims. Posts shown as written; we don't vouch for them. Data by LunarCrush.

  • StudyIQ IAS · 20.6M followers · YouTube
    Massive Cyberattack: What is PHP2Shell? Ankit Agrawal Study IQOpen post
For your tech helper

A read-only checklist for whoever helps you with your computer, or an AI assistant. Paste it into Claude, ChatGPT or a coding agent; it only looks and changes nothing.

Read-only check, change nothing, send nothing anywhere.
Is PHP Group PHP (CVE-2026-109619) installed or running on this machine or in this project?
1. Find every copy and its version (apps, packages, containers, lockfiles).
2. Compare each version against the vendor's fixed version for CVE-2026-109619. Quote the vendor page you used.
3. Report a table: where, version, fixed version, status (exposed / fixed / not installed / unsure).
4. List the exact update steps, but do not run them.
Download playbook (.md)

Code on GitHub

Repos named after this bug. Some are scanners or write-ups, some are working attack code. Do not run them on a machine you care about.

Sources