22/10/2026
Even if your code has zero bugs, your server can still get compromised.
That is why PHP2Shell is making headlines this week.
Most web attacks target mistakes in application code, like forms or database queries. PHP2Shell is different. It attacks the PHP engine itself while the server is still reading incoming requests, before your PHP files even start running.
It comes down to two main bugs:
When the server runs out of memory, PHP's cleanup system accidentally reads leftover data from memory, which attackers can use to run unauthorized code.
When a crash occurs, PHP skips its normal memory cleanup. This leaves behind broken pointers that compromise the very next request handled by the server.
This affects PHP versions 5.4 all the way to 8.5.
The fix is straightforward: update your PHP version to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 right away.
Have you patched your servers yet? Let us know in the comments.
