PHP2Shell: Who Is At Risk And How Can Businesses Stay Safe?

Two critical flaws in PHP could allow hackers to run malicious code on vulnerable servers without logging in.

Websites, online businesses and enterprise applications could face data theft, service disruption and unauthorised access.

Rated 9.2 out of 10 for severity, the vulnerabilities were patched on October 21, 2026, but businesses must still check for exposure and possible attacks.

Added to Saved Stories in Login VIEW SAVED STORIES .inc42-toggle-item-popup { display: none; position: relative; } .toggle-item-close { text-align: end; padding: 8px 12px 0px 10px; position: absolute; right: 0; cursor: pointer; } .toggle-items-content-main { display: block; position: relative; top: 27px; left: -204px; border-radius: 12px; background: #FFF; box-shadow: 0px 4px 24px 0px rgba(100, 100, 100, 0.25); width: 435px; height: 115px; } .toggle-items-content { display: flex; align-items: baseline; justify-content: center; padding-top: 22px; } .toggle-items-content .items-content-text .h4-saved-story{ color: #000; font-size: 20px; font-style: normal; font-weight: 700; line-height: normal; text-transform: capitalize; margin: 2px 0 10px 6px; } .toggle-items-content .items-content-text .myInc42-plus-dark { width: 100px !important; } .toggle-items-content .items-content-text .myInc42-light { width: 80px !important; } .toggle-items-content .items-content-text img{ height: 22px; } .view-my-feed-btn { width: 100%; text-align: center; display: flex; justify-content: center; } .view-my-feed-btn a { width: auto !important; } .view-my-feed-btn button { border-radius: 4px; background: linear-gradient(180deg, #DA1B4D 0%, #E23026 100%); color: #fff; font-size: 12px; display: inline-block !important; min-width: 162px; width: 162px !important; height: 34px !important; font-style: normal; font-weight: 700; line-height: normal; padding: 10px; cursor: pointer; } .CustomIconStyled { position: absolute; right: 180px; top: -80px; } .SubDropdownModelShare .sub-arrow-icon { width: 76px; height: 80px; position: relative; overflow: hidden; box-shadow: none; } @media (max-width:767px) { .toggle-items-content .items-content-text .h4-saved-story{ margin: 4px 0 10px 6px; font-size: 18px; } .toggle-items-content { align-items: center; } }

PHP, a programming language used to build websites, is at the centre of a major security concern after researchers uncovered two critical flaws that could let hackers take control of vulnerable servers.

Called PHP2Shell, the vulnerabilities could let attackers run malicious code on affected systems without needing to log in. Since the vulnerabilities lie in PHP itself rather than individual websites built on it, businesses cannot rely on website-level security measures alone to stay protected.

The vulnerabilities affect specific PHP versions, and fixes were released on October 21, 2026.........

© Inc42