PHP2Shell is one of the fastest-moving technology stories right now, covered by 20 different news outlets in the last 24 hours. Here is what we know, who should pay attention, and the practical steps we recommend.
What happened
- Google Cloud – Security Bulletins: GCP-2026-072. Published: 2026-10-24Description Description Severity Notes Two vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), allow an unauthenticated attacker to execute code remotely on a server running a vulnerable PHP version.…
- www.thestack.technology: Sophos, Palo Alto Networks retract early claims of PHP2Shell exploitation – but attacks are starting
- www.usthadian.com: PHP2Shell Vulnerabilities and Global Cybersecurity Risks
- The Hacker News: PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking. Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the…
- Cyber Press: CISA Warns Hackers Are Exploiting PHP2Shell Flaws to Target Web Servers
Who is affected
Based on the reports so far, this matters most for the websites, web servers and hosting accounts you run (including WordPress sites and plugins), and VPNs, firewalls and other internet-facing devices, and the AI tools and assistants your team uses. If you are not sure whether you use the affected software, that is the first thing to find out.
Is it being exploited?
There are no confirmed widespread attacks in the reports we reviewed yet, but stories like this often see attacks within days of going public. Plan to patch this week.
What to do now
- Ask your web host or developer whether your sites run the affected software or versions, and get the fix applied today.
- Update WordPress, themes and plugins, and remove anything you no longer use.
- Put a web application firewall (for example Cloudflare or your host's WAF) in front of public sites.
- Check web server and hosting logs for unknown files, new admin accounts or strange outbound connections.
- Patch or apply the vendor's mitigation on every exposed device right away.
- Turn off management access from the internet and require MFA for VPN logins.
- Review device logs for unusual logins since the issue was disclosed.
- List which AI tools staff are allowed to use, and use business plans with clear data terms.
- Do not connect AI assistants to email, files or systems with more access than they need.
- Remind staff never to paste client, financial or personal information into unapproved tools.
- Keep an eye on the vendor’s official advisory for updated guidance.
How Synova can help
When a story like PHP2Shell breaks, our managed clients do not have to wonder whether they are exposed: we check their systems, apply fixes and confirm everything is clean. If you would like us to check yours, get in touch or take our free 60-second IT risk check.
Sources
- GCP-2026-072 (Google Cloud – Security Bulletins)
- Sophos, Palo Alto Networks retract early claims of PHP2Shell exploitation – but attacks are starting (www.thestack.technology)
- PHP2Shell Vulnerabilities and Global Cybersecurity Risks (www.usthadian.com)
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking (The Hacker News)
- CISA Warns Hackers Are Exploiting PHP2Shell Flaws to Target Web Servers (Cyber Press)
- PHP2Shell Vulnerability | PHP flaw trickles down to service disruptions | PHP Security Flaw (The Daily Star)
This article summarises public reporting at the time of writing and will be most useful alongside the vendor’s official advisory.