{"id":238416,"date":"2026-10-23T13:18:59","date_gmt":"2026-10-23T20:18:59","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=238416"},"modified":"2026-10-23T13:18:59","modified_gmt":"2026-10-23T20:18:59","slug":"php2shell-php-vulnerability","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/","title":{"rendered":"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe"},"content":{"rendered":"<p>Two serious security holes were found in PHP, the behind-the-scenes software that powers a large share of the websites you visit every day. Fixes went out on Oct. 21, 2026. Until each website installs them, attackers could use the holes to take over the computers that run those sites and grab the passwords and data stored there.<\/p>\n<p><b>For most people, there is nothing to install on your phone or computer.<\/b> Website owners and hosting providers are responsible for installing the fix. You can still take steps to protect your accounts in case a site you use is compromised.<\/p>\n<p>The PHP security team announced the two flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\">in an Oct. 21 security advisory<\/a> and rated both 9.2 out of 10 for severity. The UK&#8217;s National Cyber Security Centre warned that &#8220;<a href=\"https:\/\/ncsc.gov.uk\/news\/critical-security-issue-affecting-php\" target=\"_blank\">organisations using any version of PHP are affected<\/a>.&#8221; PHP runs about 69.7% of websites whose server-side programming language is known, <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/critical-php-vulnerabilities-leaked\/\" target=\"_blank\">according to W3Techs data cited by Infosecurity Magazine<\/a>.<\/p>\n<h2>What Is PHP?<\/h2>\n<p>PHP is a programming language that runs behind the scenes on many websites. When you log in to an account, add something to a shopping cart, or post a comment, PHP is often the software doing that work on the website&#8217;s computer, called a server. It runs on servers, not on your phone or laptop. Many popular website builders, including WordPress, Drupal, and Joomla, are built on PHP.<\/p>\n<h2>How the PHP2Shell Vulnerability Works<\/h2>\n<p>Both flaws stem from errors that occur while PHP is processing a request from a website visitor. When PHP fails partway through, it can leave data from that request behind in the server&#8217;s memory. Attackers can trigger these errors deliberately and exploit the leftover data to gain access to the server.<\/p>\n<p>Both flaws involve how PHP cleans up after handling a request. According to <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\">PHP&#8217;s Oct. 21 advisory<\/a>:<\/p>\n<ul>\n<li><b>CVE-2026-109618:<\/b> When PHP runs out of memory at the wrong moment, it can stop while data is only partly set up, then treat that incomplete data as valid.<\/li>\n<li><b>CVE-2026-109619:<\/b> After an error, PHP can keep a reference to memory it has already released, and a later request handled by the same server process can reuse it.<\/li>\n<\/ul>\n<p>To exploit the flaws, an attacker sends specially built requests to a website and does not need a password. That can expose passwords, digital keys, and other secrets stored in the server&#8217;s memory, or let the attacker run their own commands on the server. <a href=\"https:\/\/wiz.io\/blog\/php2shell-php-rce\" target=\"_blank\">Wiz Research showed<\/a> the attack working against WordPress, Drupal, and Joomla sites.<\/p>\n<p>Information about the flaws leaked online on Oct. 20, a day before the fixes came out, <a href=\"https:\/\/thephp.foundation\/blog\/2026\/10\/21\/todays-php-security-release-and-how-were-strengthening-php-security\/\" target=\"_blank\">according to the PHP Foundation<\/a>. <a href=\"https:\/\/blog.cloudflare.com\/php-vulnerabilities-waf-protection\" target=\"_blank\">Cloudflare said<\/a> it saw attack traffic aimed at its customers after the leak. For a short window, PHP2Shell was effectively a <a href=\"https:\/\/www.mcafee.com\/learn\/what-is-a-zero-day-threat\/\">zero-day threat<\/a>, meaning attackers knew about it before a fix existed.<\/p>\n<p>Artificial intelligence helped find the flaws. <a href=\"http:\/\/openai.com\/index\/coordinated-disclosure-of-critical-vulnerabilities\" target=\"_blank\">OpenAI said<\/a> the research firm Calif used one of its AI models to find one of them, and Wiz independently found both with help from AI tools.<\/p>\n<h2>How the PHP Exploit Could Affect You<\/h2>\n<p>The main risk to you is indirect: a website you use gets hacked before it installs the fix. Think of it like a store whose back door was left unlocked. You didn&#8217;t do anything wrong, but your information inside the store could still be taken.<\/p>\n<p>If an attacker breaks into a site&#8217;s server, they could:<\/p>\n<ul>\n<li><b>Steal account information<\/b>, such as usernames, email addresses, and passwords stored on that site.<\/li>\n<li><b>Grab the site&#8217;s own keys and passwords<\/b>, which attackers can use to reach other systems that hold customer data.<\/li>\n<li><b>Change what the site shows you<\/b>, because whoever controls the server controls the pages it sends.<\/li>\n<\/ul>\n<p>You may also notice some sites going offline for a while. Some Dutch government and education sites went down, and the HR software company BambooHR took its service offline as a precaution. A site going offline doesn&#8217;t by itself mean your data was stolen.<\/p>\n<p>Attackers moved quickly. <a href=\"https:\/\/aws.amazon.com\/blogs\/security\/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot\/\" target=\"_blank\">Amazon Threat Intelligence reported<\/a> that one of its decoy servers caught an attack attempt on Oct. 17, four days before the flaws were made public, and said PHP2Shell &#8220;is now seeing broad exploitation attempts in the wild.&#8221; One web hosting platform blocked more than 60,000 suspicious requests probing the flaws by the evening of Oct. 21, <a href=\"https:\/\/thehackernews.com\/2026\/10\/someone-tried-to-exploit-php2shell-4.html\" target=\"_blank\">according to The Hacker News<\/a>. As of Oct. 23, no successful break-ins had been publicly confirmed, <a href=\"https:\/\/www.securityweek.com\/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge\/\" target=\"_blank\">according to SecurityWeek<\/a>.<\/p>\n<h2>Warning Signs to Watch For<\/h2>\n<p>You can&#8217;t see whether a website runs PHP or has been patched. What you can watch for are signs that a site you use was affected, or that scammers are using the news to trick you. McAfee&#8217;s guide to <a href=\"https:\/\/www.mcafee.com\/learn\/phishing-email-examples-how-to-recognize-a-phishing-email\/\">recognizing a phishing email<\/a> covers more of the tricks to look for.<\/p>\n<table>\n<tbody>\n<tr>\n<td>\n<p><b>Red Flag<\/b><\/p>\n<\/td>\n<td>\n<p><b>Why It Matters<\/b><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><b>A message telling you to download a &#8220;PHP update&#8221; or &#8220;PHP2Shell patch&#8221; for your phone or computer<\/b><\/p>\n<\/td>\n<td>\n<p>PHP runs on website servers, not personal devices. A message like this is a scam.<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><b>An email from a company saying your data may have been exposed<\/b><\/p>\n<\/td>\n<td>\n<p>The site may have been breached. Act on it, but log in by typing the site&#8217;s address yourself instead of clicking the link.<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><b>Password reset emails or login alerts you didn&#8217;t request<\/b><\/p>\n<\/td>\n<td>\n<p>Someone may be trying to use stolen login details.<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><b>A familiar site suddenly asks for unusual information or tries to download a file<\/b><\/p>\n<\/td>\n<td>\n<p>The site may have been tampered with. Leave it and check the company&#8217;s official channels.<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><b>Charges you don&#8217;t recognize on a card you used with an online store<\/b><\/p>\n<\/td>\n<td>\n<p>Payment details may have been stolen.<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>How to Protect Yourself<\/h2>\n<p>You can&#8217;t patch other people&#8217;s websites, but you can limit the risk to yourself if one of them is breached. These steps help with PHP2Shell and with data breaches in general.<\/p>\n<ol>\n<li><b>Use a different password for every account.<\/b> If one site leaks your password, attackers can&#8217;t use it to get into your other accounts. A password manager can create and remember them for you.<\/li>\n<li><b>Turn on <\/b><a href=\"https:\/\/www.mcafee.com\/learn\/the-importance-of-two-factor-authentication-to-your-security\/\"><b>multi-factor authentication<\/b><\/a><b>.<\/b> It adds a second step, like a code sent to your phone, so a stolen password alone isn&#8217;t enough to get in.<\/li>\n<li><b>Set up alerts with your bank and card issuer.<\/b> Text or email alerts for new charges let you spot fraud the day it happens, instead of weeks later on a statement.<\/li>\n<\/ol>\n<p><b>If you run a personal blog or small business website:<\/b> Ask your hosting company to confirm that PHP is updated to version 8.5.12, 8.4.27, 8.3.36, 8.2.35, or newer. Updating WordPress or your plugins is not enough on its own, <a href=\"https:\/\/blog.cloudflare.com\/php-vulnerabilities-waf-protection\" target=\"_blank\">according to Cloudflare<\/a>, because the fix has to be made to PHP itself. If your site runs an older PHP version, ask your host to move it to a supported one.<\/p>\n<h2>What to Do If Your Information Was Exposed<\/h2>\n<p>If a company tells you your data may have been exposed, act quickly. Being caught up in a breach is not your fault, and these steps can limit the damage.<\/p>\n<ul>\n<li><b>Change your password<\/b> for that site, and on any other account where you used the same one.<\/li>\n<li><b>Turn on multi-factor authentication<\/b> for that account and for your email.<\/li>\n<li><b>Call your bank or card issuer<\/b> if payment details may have been exposed, and ask about freezing or replacing the card.<\/li>\n<li><b>Consider a free credit freeze<\/b> with Equifax, Experian, and TransUnion. It stops anyone from opening new credit in your name.<\/li>\n<li><b>Go to <\/b><a href=\"https:\/\/www.identitytheft.gov\" target=\"_blank\"><b>IdentityTheft.gov<\/b><\/a> if your Social Security number or other identity details were exposed. It creates a step-by-step recovery plan.<\/li>\n<li><b>Keep records<\/b> of the breach notice, any suspicious messages, and any charges you dispute.<\/li>\n<\/ul>\n<h2>How to Report It<\/h2>\n<p>If you lost money or think someone is using your information, report it:<\/p>\n<ul>\n<li><b>FTC: <\/b><a href=\"https:\/\/reportfraud.ftc.gov\" target=\"_blank\">ReportFraud.ftc.gov<\/a> for scams and fraud<\/li>\n<li><b>FBI Internet Crime Complaint Center:<\/b> <a href=\"https:\/\/www.ic3.gov\" target=\"_blank\">ic3.gov<\/a> for online crime, including hacked websites<\/li>\n<li><b>Identity theft:<\/b> <a href=\"https:\/\/www.identitytheft.gov\" target=\"_blank\">IdentityTheft.gov<\/a><\/li>\n<li><b>Your bank or card issuer:<\/b> for any unauthorized charges<\/li>\n<li><b>Local police:<\/b> if you lost money or were threatened<\/li>\n<\/ul>\n<p>PHP2Shell is a problem that website owners have to fix, but it can still impact your accounts if a site you use is breached. The most important thing you can do is use a unique password and multi-factor authentication for every account, so one breach doesn&#8217;t expose the rest.<\/p>\n<h2>FAQ<\/h2>\n<h3>What is PHP2Shell?<\/h3>\n<p>PHP2Shell is the nickname for two serious security flaws in PHP, software that runs behind the scenes on many websites. Fixes were released on Oct. 21, 2026.<\/p>\n<h3>Do I need to update my phone or computer?<\/h3>\n<p>No. PHP runs on website servers, not personal devices, so the fix is up to website owners. Any message telling you to install a &#8220;PHP update&#8221; on your device is a scam.<\/p>\n<h3>Is my information at risk?<\/h3>\n<p>It could be, if a site you use was hacked before it installed the fix. Watch for breach notices from companies you do business with, and use unique passwords and multi-factor authentication.<\/p>\n<h3>How do I know if a website I use was affected?<\/h3>\n<p>You can&#8217;t tell by looking at a site. Companies that find a breach may notify you by email or post an update on their official website. Check the company&#8217;s site directly rather than trusting a link in an email.<\/p>\n<h3>Has the PHP exploit been used in real attacks?<\/h3>\n<p>Yes. Security firms including Amazon and watchTowr have reported widespread attack attempts, and Amazon saw one as early as Oct. 17, before the fix was public. No confirmed break-ins had been publicly reported as of Oct. 23.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PHP2Shell PHP vulnerability: Fixes went out Oct. 21. Learn what the flaw means for you, whether you need to do anything, and how to protect your accounts.<\/p>\n","protected":false},"author":674,"featured_media":235248,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[10661],"tags":[],"coauthors":[3973],"class_list":["post-238416","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-internet-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe | McAfee Blog<\/title>\n<meta name=\"description\" content=\"PHP2Shell PHP vulnerability: Fixes went out Oct. 21. Learn what the flaw means for you, whether you need to do anything, and how to protect your accounts.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"PHP2Shell PHP vulnerability: Fixes went out Oct. 21. Learn what the flaw means for you, whether you need to do anything, and how to protect your accounts.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-23T20:18:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"600\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe\",\"datePublished\":\"2026-10-23T20:18:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/\"},\"wordCount\":1613,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg\",\"articleSection\":[\"Internet Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/\",\"name\":\"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg\",\"datePublished\":\"2026-10-23T20:18:59+00:00\",\"description\":\"PHP2Shell PHP vulnerability: Fixes went out Oct. 21. Learn what the flaw means for you, whether you need to do anything, and how to protect your accounts.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg\",\"width\":600,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Internet Security\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/internet-security\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe | McAfee Blog","description":"PHP2Shell PHP vulnerability: Fixes went out Oct. 21. Learn what the flaw means for you, whether you need to do anything, and how to protect your accounts.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe | McAfee Blog","og_description":"PHP2Shell PHP vulnerability: Fixes went out Oct. 21. Learn what the flaw means for you, whether you need to do anything, and how to protect your accounts.","og_url":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2026-10-23T20:18:59+00:00","og_image":[{"width":600,"height":600,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg","type":"image\/jpeg"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe","datePublished":"2026-10-23T20:18:59+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/"},"wordCount":1613,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg","articleSection":["Internet Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/","url":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/","name":"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg","datePublished":"2026-10-23T20:18:59+00:00","description":"PHP2Shell PHP vulnerability: Fixes went out Oct. 21. Learn what the flaw means for you, whether you need to do anything, and how to protect your accounts.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/09\/260805_BI_McAfee_TIGHT_03_01351-1.jpg","width":600,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/internet-security\/php2shell-php-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Internet Security","item":"https:\/\/www.mcafee.com\/blogs\/internet-security\/"},{"@type":"ListItem","position":3,"name":"PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/238416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=238416"}],"version-history":[{"count":3,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/238416\/revisions"}],"predecessor-version":[{"id":238419,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/238416\/revisions\/238419"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/235248"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=238416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=238416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=238416"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=238416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}