Everything about PHP2Shell
2026 software security vulnerability
PHP2Shell is a pair of high-impact computer vulnerabilities concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE). PHP is a popular programming language on which many website and web application codebases are built; these vulnerabilities were estimated to affect nearly 70% of websites at the time of their disclosure. The vulnerabilities were discovered with the help of AI in August 2026 and their existence was publicly announced on 20 October 2026. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits could be used. Wikipedia →
🧠Start here: a 6-step reading path
- Read the overview: PHP2ShellA 5-minute orientation
- Pick up a classic book: Coding for penetration testersThe most-reprinted book on the subject
- Go sideways: Black October (information security)A closely related topic
- Go sideways: Log4ShellA closely related topic
đź“– Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
- No matching papers found.
đź“š Books worth reading
Coding for penetration testersJason Andress · 2011
MongoDB and PHPSteve Francia · 2012
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
đź”— Related topics
- Black October (information security) In information security, October 2026 has been referred to as Black October due to several major security incidents and vulnerability disclosures. The…
- Log4Shell Log4Shell (CVE-2021-44228) is a vulnerability reported in November 2021 in Log4j, a popular Java logging framework, involving arbitrary code execution…
- SMBGhost SMBGhost (or SMBleedingGhost or CoronaBlue) is a type of security vulnerability, with wormlike features, that affects Windows 10 computers and was first…
- Speculative Store Bypass Speculative Store Bypass (SSB) (CVE-2018-3639) is the name given to a hardware security vulnerability and its exploitation that takes advantage of speculative…
- Microsoft Support Diagnostic Tool The Microsoft Support Diagnostic Tool (MSDT) is a legacy service in Microsoft Windows that allows Microsoft technical support agents to analyze diagnostic…
- Oligo Cyber Security Oligo Cyber Security (Oligo Security) is an Israeli cybersecurity organization headquartered in Tel Aviv. Its platform uses eBPF-based sensors to detect…
- EternalBlue EternalBlue is a computer exploit software developed by the U.S. National Security Agency (NSA). It is based on a zero-day vulnerability in Microsoft Windows…
- Arbitrary code execution In computer security, arbitrary code execution (ACE) is an attacker's ability to run any commands or code of the attacker's choice on a target machine…