# PHP2Shell flaws put servers across much of the web at risk

- URL: https://talkfuse.com/story/we-shouldnt-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue/
- Published: 2026-10-26T13:14:00+00:00
- Updated: 2026-10-26T13:34:57+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/26/we-shouldnt-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue/5305186
- Topics: Art, Culture, Cybersecurity, Technology

## Key points

- PHP2Shell flaws could enable remote code execution.
- An estimated 70 per cent of websites use affected PHP code.
- Emergency patches are available, but some legacy systems cannot update directly.

## Summary

Two related memory safety flaws in PHP, grouped under the name PHP2Shell, could let attackers run code remotely on affected servers. The vulnerabilities matter because PHP is used by an estimated 70 per cent of websites, leaving a large part of the web potentially exposed.

The flaws affect PHP versions dating back to about 5.4, and were first identified in August. Emergency patches were released on Wednesday after leaks and an exploit video prompted warnings; some systems running very old versions have no direct update path and may need to be shut down and reinstalled.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.