PHP2Shell: The Internet’s Biggest Security Scare in Years Just Hit. Here’s What Banks and Credit Unions Need to Do NOW

On October 21, 2026, the PHP project shipped emergency fixes for two critical flaws that let an attacker take over a web server with a single request, no login required. The pair is called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and it sits underneath roughly 7 in 10 websites on the internet.

For banks and credit unions, the risk is not just your own website. It is every loan application, account-opening flow, rate widget, chat tool and marketing platform you have embedded or linked from it. If any of those run on PHP and are not patched, your members and customers are typing their Social Security numbers into a server that may already belong to someone else.

This is a warning, and a checklist. Patch today, then start asking your vendors hard questions.

What PHP2Shell is, in plain English

PHP is the programming language that runs behind the scenes of WordPress, Drupal, Joomla, Magento, Laravel apps and countless custom portals. These two bugs are in PHP itself, not in any one plugin or app, so every site on an unpatched version is exposed no matter how well its own code was written (Patchstack).

Both flaws involve how PHP cleans up memory when a web request fails partway through, for example when it runs out of memory (Cloudflare):

• CVE-2026-109618: PHP gets interrupted by an out-of-memory error while request data is only half set up, then treats that half-built data as valid during cleanup.
• CVE-2026-109619: after a fatal error, leftover internal data can outlive the memory behind it, and the next request handled by the same PHP worker can pick it up.

An attacker who crafts the right request can turn that corrupted memory into running their own code on the server. PHP rates both 9.2 out of 10 on the CVSS v4.0 scale; watchTowr scored it a full 10 (Wikipedia). Researchers also showed the bug can be used to read the server’s working memory, which may hold passwords, tokens and API keys (Patchstack).

Timeline. Details leaked on Hacker News on October 20, ahead of the planned disclosure (Infosecurity Magazine). PHP released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on the morning of October 21 (Huntress). The flaws were found by Wiz, Calif.io, OpenAI and Quarkslab, and Cloudflare coordinated firewall protections ahead of release (Cloudflare).

How big this actually is

PHP runs about 70% of all websites whose server-side language can be identified, according to W3Techs (W3Techs). That share has been as high as 79% in past years. No other single piece of web software touches that much of the internet at once.

The people who study this for a living are not mincing words. Researcher Kevin Beaumont called it “one of the biggest vulns in years” (Help Net Security), and the scale invites comparison to Log4Shell, the 2021 flaw that kept security teams busy for months.

The disruption is already visible. In the Netherlands, organizations pulled portals offline pre-emptively, causing temporary outages of government services including DigiD and MijnOverheid (Techzine).

Is it being exploited? Reports conflict as of October 21. Cloudflare said it was seeing early attack attempts, and Patchstack and Aikido reported active exploitation, while PHP itself has not reported attacks and CISA has not yet added the flaws to its Known Exploited Vulnerabilities catalog (SOCRadar). The Dutch national cybersecurity center says public proof-of-concept code exists and expects large-scale exploitation soon (Brandefense). Plan as if attackers are already scanning, because they are.

Why banks and credit unions should care: it’s your vendors too

Your core banking system is probably not written in PHP. That is not the question. The question is how many of the things your customers and members touch are.

A typical community bank or credit union website is a patchwork. The homepage might be on WordPress. The loan application is a third-party form. Account opening is a white-labeled portal on a vendor’s subdomain. Rate tables, calculators, chat, appointment booking, event registration and email capture are all embedded scripts or iframes from someone else’s server. Any one of those can run on PHP, and your visitor cannot tell the difference: it all looks like your brand.

Where PHP2Shell can hide in a financial institution’s digital footprint:

• Public website and CMS. WordPress, Drupal or Joomla sites, plus their hosting company’s PHP version.
• Digital loan applications. Mortgage, auto, HELOC and personal-loan intake forms, often hosted by a fintech or LOS vendor.
• Online account opening. Membership and deposit-account apps that collect SSNs, driver’s licenses and funding details.
• Embedded widgets. Rate tables, loan and savings calculators, branch locators, live chat, chatbots.
• Marketing tools. Landing-page builders, form tools, email platforms, CRM web-to-lead forms, survey and event tools.
• Member and customer portals. Bill pay add-ons, document upload portals, e-sign pages, card-controls microsites.
• Internal and partner portals. Employee intranets, HR and benefits sites, CUSO and indirect-lending dealer portals.
• Forgotten sites. Old campaign microsites, foundation and scholarship sites, staging servers nobody shut down.

The last item matters most. Attackers scan the whole internet, not just your homepage. An abandoned 2019 promo site on PHP 7.4 with your logo on it is an open door, and PHP 7.4 gets no official release, only a bare-bones source patch most hosts will never apply (BleepingComputer).

The stakes are specific to our industry. A compromised loan or account-opening page can silently skim personal and financial data, inject fraudulent payment instructions, or host a credential-phishing page under your trusted domain. That brings regulatory exposure under GLBA, third-party risk expectations from your examiners, and member trust damage that no marketing campaign can buy back.

The checklist: what to check now

Updating PHP is the only complete fix. PHP’s own workarounds close some attack paths, not all of them (Brandefense).

Today

• [ ] Build a list of every web property tied to your brand: main site, subdomains, microsites, staging sites, and every vendor-hosted page you link to or embed.
• [ ] For sites you control, confirm the PHP version. Patched versions are 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later (Help Net Security).
• [ ] Call your web host or agency and get written confirmation that PHP is patched and every PHP process was restarted (PHP-FPM, Apache, queue workers). A patch that isn’t loaded doesn’t protect you (ma.ttias.be).
• [ ] Anything on PHP 8.1 or older: upgrade, get a backported fix from your Linux distribution or LTS vendor, or take it offline (BleepingComputer).
• [ ] Put public sites behind a web application firewall. Cloudflare has pushed emergency rules, but calls them a stopgap until you patch (The Hacker News).
• [ ] Send the vendor questions below to every third party that hosts a page your customers or members use.

If a server can’t be patched within hours

• [ ] Ask your host to apply PHP’s temporary settings: memory_limit = -1 and session.upload_progress.enabled = 0, set at the server level so apps can’t override them (Aikido). These are a crutch, not a fix, and removing the memory cap means watching server memory closely (Sansec).
• [ ] Limit request sizes at the proxy or web server (Cybersecurity News).
• [ ] If it handles sensitive data and can’t be protected, take it down. A “temporarily unavailable” page is cheaper than a breach notice.

This week

• [ ] Look for signs of compromise: odd file-upload requests followed by memory errors or bursts of HTTP 500s, unusually large session cookies, unexplained worker restarts, new admin accounts, changed PHP files, web shells and strange outbound connections (Aikido).
• [ ] Rotate passwords, API keys and tokens stored on internet-facing PHP servers, since the flaw can expose server memory.
• [ ] Check integrations that connect your website to core, LOS or CRM systems. Rotate their credentials too.
• [ ] Brief your fraud, compliance and member-service teams so they recognize phishing or skimming reports tied to your site.
• [ ] Document what you checked and when. Your examiners will ask how you handled third-party risk on this one.

Before year-end

• [ ] Plan the move off PHP 8.2, which reaches end of life on December 31, 2026 (Brandefense).
• [ ] Shut down every abandoned site and microsite you found in step one.

Questions to send your vendors today

Copy these into an email to every vendor that hosts a page, form or widget your customers or members use. Ask for written answers within 48 hours.

1. Does any part of the service you provide us, including hosted pages, forms, widgets, APIs or admin portals, run on PHP?
2. If yes, which PHP versions, and have all of them been updated to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later? On what date and time?
3. Have all PHP processes been restarted since the update?
4. Are any systems on PHP 8.1 or older? If so, what is the plan and timeline?
5. Do you rely on any subcontractors or fourth parties running PHP in the path of our data? Have they confirmed patching?
6. Have you reviewed logs from October 20 onward for signs of exploitation? What did you find?
7. Will you rotate any credentials, API keys or tokens that connect your system to ours?
8. Who is our point of contact if you discover a compromise, and how fast will you notify us?

A vendor who can’t answer the first question quickly is telling you something about their security program. Note it in your vendor risk file.

What this shows about how vulnerable we are

PHP2Shell is a reminder that your security is only as strong as the oldest server touching your brand. Most of the internet sits on a handful of shared building blocks, and when one cracks, everyone built on it is exposed at the same moment, including the vendors you trusted to handle it.

Financial institutions have spent years hardening core systems. The front door, though, is now the digital experience: the website, the loan app, the account-opening flow, the marketing stack. That is exactly where third-party code piles up fastest and gets reviewed least.

The institutions that come through this well will be the ones that already know every site and vendor in their footprint, can get a straight answer from each in hours, and treat their marketing technology with the same rigor as their core. If this week proves you can’t do that yet, now is the time to fix it.

Sources

• PHP2Shell: Critical PHP vulnerabilities patched, update now! — Help Net Security
• Major security alert: PHP vulnerable to critical RCE — Patchstack
• Cloudflare deploys protections against php2shell — Cloudflare
• PHP ships emergency patches for critical PHP2Shell flaws — BleepingComputer
• PHP Releases Emergency Patches for PHP2Shell Flaws — Cybersecurity News
• Rapid Response: php2shell — Huntress
• Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patch — Infosecurity Magazine
• PHP2Shell: What Actually Protects You — The Hacker News
• What you need to know about PHP2shell — Aikido
• PHP2Shell: Critical PHP RCE — Sansec
• PHP2Shell: CVE-2026-109618 & CVE-2026-109619 — SOCRadar
• PHP2Shell: Two Critical PHP Flaws Reported as RCE — Brandefense
• PHP CVE-2026-109618 and CVE-2026-109619: early mitigation steps — ma.ttias.be
• Serious vulnerabilities in PHP, emergency patches on the way — Techzine
• Usage statistics of PHP for websites — W3Techs
• PHP2Shell — Wikipedia

- Advertisement -