PHP2Shell vulnerability: what it teaches full-stack developers

The PHP2Shell vulnerability is two bugs in the core of PHP, the language behind about seven in ten websites, that let an attacker run code on a web server without logging in. PHP patched both on the 21st of October 2026 and told every user to update at once ¹. Government portals in Europe went offline for a day rather than stay exposed ⁷. It is not the biggest attack in internet history, because most of what happened this week was defenders patching. It is the widest exposure in years, and the first one found largely by AI. For anyone who builds web applications, on Node.js as much as PHP, it is a plain lesson in production work.

What the PHP2Shell vulnerability actually is

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both scored 9.2 of a possible 10 on the CVSS 4.0 scale ³. Neither is in WordPress, Laravel or any application code. They sit in the engine itself, in how PHP cleans up after a request that ran out of memory.

In the first, PHP runs out of memory part-way through storing a form field. It has already counted the field, but never finished creating it, and the clean-up code then treats the half-built entry as real data ⁴. In the second, a PHP worker keeps a piece of state from one request and reuses it in the next, even though the memory it points to was freed ³. An attacker who can send a large, carefully shaped POST request to the server can turn either into running their own code. Wiz demonstrated this against the current WordPress, Drupal and Joomla images, and showed a separate trick that leaks the server's memory, which can include passwords, tokens and keys, through the session cookie ².

Two facts make it unusually broad. Every way of serving PHP over the web is affected: PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed ³. And the affected code goes back to PHP 5.4, released in 2012, so fixes exist only for PHP 8.2 to 8.5; PHP 7.4 to 8.1 get minimal source patches and anything older gets nothing ³. PHP powers 69.3% of websites whose server-side language is known, and of those, 26.9% still run PHP 7 and 7.7% run PHP 5 ⁸.

Why websites went dark

The fix is the patch release of each supported line, PHP 8.2, 8.3, 8.4 and 8.5, published that day ¹. The release was moved a day earlier than planned after the CVE numbers leaked, and PHP's own advisory says the interim settings people were sharing "do not make an installation safe" ¹³. CERT-EU went further: patch now, and if you cannot, isolate the application from the public internet until you have ⁵.

Many operators took that literally. The Dutch National Cyber Security Centre took its own site down, followed by the Port of Rotterdam, the national government portal, hospital sites and the five largest political parties. Finland's government IT provider pulled public services offline, France's Interior Ministry put every site into maintenance, and Wikipedia's operator took systems down until they were patched ⁷. Amazon's threat team had seen an exploitation attempt on the 17th of October, four days before the patch existed, and by the evening of the 21st Cloudflare reported attempts climbing from tens of thousands to millions ³⁶.

That is the real shape of the story: a day of downtime beats a breach.

AI found it. Will AI exploit it?

The discovery is the part that changes the field. A red-teaming firm called Calif found the first issue on the 1st of August using OpenAI's GPT-5.6 Sol. Wiz found it independently on the 19th of August using Google's Gemini 4 Argon, GPT-5.6 Sol and its own research agent, confirmed remote code execution against Drupal and WordPress within two days, and reported it to PHP on the 24th of August ²⁶. Wiz's own assessment is that a single researcher did in a week what would have taken a strong team months ².

The worry in the headlines is that the same tools let attackers build exploits just as fast, and OpenAI said so in its own warning ⁶. What is on record so far is narrower: mass scanning, exploit code circulating, and attempts arriving at a rate that suggests several groups at once ³⁴. No source yet shows an AI-driven attack campaign. The sober reading is that the window between a patch and a working exploit is now days, not weeks, and your patch process has to fit inside it ⁴.

What this changes for a full-stack developer

If you build on Node.js, Express and Next.js, it is tempting to file this as someone else's problem. On the same day PHP shipped its fix, Node.js shipped a security release across the 22, 24 and 26 lines with ten fixes, four of them high severity, including a Brotli decoder bug that permits remote code execution ⁹. What PHP2Shell tests is not which language you chose but whether your working habits hold up.

These are the habits the incident rewards, and each maps to a specific part of the MERN & Next.js with GenAI course:

Habit the incident tests	Where it is built
Know what version of the runtime every service runs, including the one baked into your Docker image	Deployment, Containerization and CI/CD (module 6)
Cap request body size at the proxy, and set memory limits at the container, not inside the app	API Security and Secure Coding Practices (modules 2 and 3)
Watch error logs for a pattern, such as memory exhausted before any script ran	Monitoring and Logging (module 6)
Rebuild and redeploy a patched image inside a day, with tests, not by hand on the server	CI/CD Pipelines and Automated Testing (modules 3 and 6)
Keep credentials out of process memory where you can, and rotate them after an incident	Authentication, Authorization and API Security (module 3)

Datadog's detection guidance reads like a checklist of the same things: flag unusually long form field names, make sure your WAF can inspect large bodies without truncating them, and treat a web worker spawning a shell as the clearest sign of compromise ⁴. None of this is PHP-specific. A Node service behind Nginx needs the same body limit, the same log watch and the same rebuild path.

The AI part cuts both ways. The same assistants that found the bug will read your package.json and Dockerfile and tell you which base image is behind a security release; you write the fix, the assistant checks the diff against the advisory. That is how the course's AI Coding Assistants topic is taught: the assistant drafts, you verify against the vendor's own note, because on a patch day that is the only source that counts.

What to do this week

If you run anything on PHP, update to a fixed version today, then restart every worker and rebuild every container image, because a patched command-line PHP does nothing for the interpreter inside an old image ⁴. If you cannot update, CERT-EU's interim settings reduce exposure but do not remove it ⁵.

If you run Node.js, update to 22.23.4, 24.22.1 or 26.12.1 for the same reasons ⁹. Either way, write down the version of every runtime you ship, where it is set, and who rebuilds it. That list is what most teams discovered they did not have on the 21st of October.

What is not yet known: how many Indian sites were hit, since no Indian advisory had been published at the time of writing; and whether a working public exploit existed on patch day, which PHP's team said it had not seen while others reported one circulating ³.

Frequently asked questions

Is the PHP2Shell vulnerability the biggest internet attack in history?

No. It is the widest exposure in years, because PHP runs about seven in ten websites and the bug goes back fourteen years. The attack is still unfolding and most of the activity recorded so far is scanning and attempted exploitation, not confirmed breaches. The biggest effect to date has been deliberate downtime by operators who chose to patch before serving traffic again.

Does PHP2Shell affect Node.js or Next.js applications?

Not directly, since the bugs are in PHP's engine. Node.js had its own security release on the same day with four high-severity fixes, so the lesson applies to every stack. Also check anything PHP-based that sits beside your app, such as a WordPress marketing site or an admin tool.

How do I know if my server was already attacked?

Look for oversized POST requests followed by memory-exhausted errors at "Unknown on line 0", unusually large or malformed session cookies, worker crashes, and above all a web worker that started a shell. A successful exploit can return a normal 200 response, so do not rely on error codes alone.