PHP2Shell: why static sites are not affected

On 21 October 2026, the PHP team closed two critical flaws in the core of PHP that have become known as PHP2Shell. They let an attacker run their own code on the web server without signing in – wherever PHP answers web requests, for example with WordPress, which requires PHP.

What PHP2Shell is

These are two vulnerabilities in PHP itself, not in a plugin:

• CVE-2026-109618: If PHP runs out of memory during a request, memory is left in an invalid state. Crafted form requests can trigger exactly that.
• CVE-2026-109619: A PHP process keeps state from an earlier request although its memory has already been freed. A later request can use that state to inject code.

PHP rates both at 9.2 out of 10 under CVSS 4.0. Code execution with the rights of the web server has been demonstrated with Apache and mod_php, and for the second flaw also with PHP-FPM. The US agency CISA has listed both as actively exploited since 26 October.

What site owners should do now

• Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 – according to PHP the only complete protection – and then restart all PHP processes.
• PHP 8.1 and older get no fix, because these branches are no longer supported. The only way out is moving to a supported branch.
• If you cannot update today, the interim measures from the PHP advisories lower the risk without removing it: session.upload_progress.enabled=0, on PHP 8.5 also fatal_error_backtraces=0, and memory_limit=-1 together with tight limits on request size at the web server in front.
• On shared hosting the update is up to the provider – ask which PHP version is running.

How we build websites

Our websites contain no PHP. We build them with Astro as static sites: every page is created once, at build time, as a finished HTML file, and the web server – nginx behind Traefik – only delivers files. When someone opens a page, no program of the website runs on the server to process the request. Flaws like PHP2Shell have nothing to attack.

• No PHP, no database, no admin login on the web server: there is nothing through which content could be changed from outside.
• Forms send their submissions to our own form service, which stops spam with ALTCHA proof-of-work – without cookies and without foreign CAPTCHA providers (how it works). The website itself needs no server code for it.
• Built and delivered in GitLab: every change passes a type, SEO and link check; only the protected main branch is deployed.
• Dependencies are checked by the pipeline for known vulnerabilities and for their licences on every change and every week. On top of that, we rebuild all sites every week.
• Security headers: the Content Security Policy allows scripts only from the site’s own address and from two services of our own, the visitor statistics and the form service. HSTS with preload enforces HTTPS, and no other site may embed our pages.

Where static websites still need care

Static does not mean maintenance-free: the web server, the reverse proxy and the operating system still need security updates, and so does the form service. But these are a few manageable building blocks – instead of PHP, a database, a theme and plugins, each of which can be attacked on its own.

We will gladly build your website this way, too.

Sources

• PHP security advisory on CVE-2026-109618, 21 October 2026: GHSA-w8hw-w9fx-j79w – cause, CVSS 4.0: 9.2, fixed versions, interim measures
• PHP security advisory on CVE-2026-109619, 21 October 2026: GHSA-6wmf-4rv5-p3rp – cause, CVSS 4.0: 9.2, fixed versions, interim measures
• CISA, Known Exploited Vulnerabilities: both CVEs added on 26 October 2026 – data in the official repository cisagov/kev-data, as of 28 October 2026
• The name “PHP2Shell”: Help Net Security, 21 October 2026
• PHP: supported versions – on 29 October 2026 the branches 8.2 to 8.5
• WordPress: requirements – PHP 8.3 or greater recommended
• Astro: on-demand rendering – by default, pages are pre-rendered at build time as static pages
• Response headers of esn.ge: own request on 29 October 2026 (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options: deny)