PHP2Shell flaw and Google's advice if your site goes down

The team that maintains PHP, the programming language behind a large share of the world's websites, rushed out emergency fixes on Tuesday, 21 October, for two critical flaws known together as PHP2Shell. The bugs can let an attacker take control of a web server with a single request, without logging in, and attempts to exploit them were seen before the fixes were published.

As website owners scramble to update, Google's John Mueller has offered advice for anyone who has to take their site offline to do it: return an HTTP 503 status code, not a timeout or an error page, so that the site's place in Google Search is protected, Search Engine Roundtable reported.

Key points

• PHP2Shell is two flaws, CVE-2026-109618 and CVE-2026-109619, that can allow remote code execution without logging in.
• PHP rates both at 9.2 out of 10 on the CVSS v4.0 severity scale.
• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official update.
• Affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed; mod_php is seen as the highest risk.
• Attack attempts were seen before disclosure; Cloudflare has added temporary firewall rules for all its customers.
• Google's advice for sites taken offline to patch: serve HTTP 503, not a timeout, 404 or 500.

What is PHP2Shell?

PHP2Shell is the name given to two security flaws in the core of PHP itself, not in a plugin or a framework built on top of it. That is what makes them so serious: almost any website that runs PHP to serve web pages is potentially exposed, whatever software it uses.

According to Help Net Security and BleepingComputer, a working attack has been demonstrated in which a single unauthenticated request can trigger the flaw before any of the website's own code runs. That means a site's own security checks, login pages and plugins do not stop it.

PHP rates both flaws at 9.2 out of 10 on the CVSS v4.0 scale, and the security firm watchTowr rated one a full 10, The Hacker News and other outlets reported. The flaws were found by researchers from security firms including Calif and Wiz, BleepingComputer reported.

Which websites are affected?

Reports say every PHP installation that serves web requests is affected, across the common ways PHP is run:

• PHP-FPM, used with Nginx and many modern hosts.
• Apache with mod_php, which the PHP team considers the highest-risk setup.
• php-cgi.
• FrankenPHP.
• LiteSpeed, used by many shared hosting companies, including in India.

Search Engine Roundtable reported that the flaws affect PHP from version 5.4 through 8.5.11. In practice, that covers almost every PHP website still running.

PHP powers WordPress, Drupal, Joomla, Magento, Laravel, CodeIgniter and countless custom sites. Many Indian small businesses, news sites, schools and government-linked portals run on shared hosting with PHP, so the number of exposed sites in India is likely to be large.

Which versions fix it?

PHP's core developers have stressed that updating is the only real fix. Temporary workarounds reduce the risk but do not fully protect a server, PHP core developer Gina Peter Banyard said, according to BleepingComputer.

How the attack unfolded

Cloudflare's chief technology officer said the company was already seeing early attacks against both flaws before the patches came out, BleepingComputer reported. Cloudflare has since added temporary web application firewall rules that block known ways of exploiting PHP2Shell, and made them available to all its customers, including those on free plans.

The UK's National Cyber Security Centre told organisations to update systems running PHP immediately, or to take them offline until they can be patched.

What to do now, step by step

If you own or run a PHP website, here is the order of work most security teams recommend:

1. Find out your PHP version. In cPanel, look under "MultiPHP Manager" or "Select PHP Version". On a server you control, run php -v on the command line. Check the version used for the website, not only the command line, because they can differ.
2. Update to a fixed version. On shared hosting, you usually cannot do this yourself. Ask your hosting company when it will install the fixed PHP packages for your version.
3. If you cannot update today, reduce the risk. PHP's advisory lists temporary steps, such as turning off the session.upload_progress.enabled setting and lowering post_max_size, but warns that these do not fully protect a server.
4. Put the site behind a web application firewall if it is not already. Cloudflare's temporary rules cover known attack methods, but attackers can bypass a firewall by going straight to the server's own address if that address is known.
5. Check for signs of a break-in. Look for unfamiliar files in your web folders, new admin users, unexpected scheduled tasks, and changes to .htaccess or configuration files.
6. Change passwords and keys for databases, admin accounts and connected services if there is any sign the server was compromised.
7. Upgrade old PHP branches. If your site still runs PHP 8.1 or older, this is a strong reason to plan the move to a supported version.

Google's advice if you take your site offline

Some site owners will decide to take their site down while they wait for a fix. That is where Google's advice comes in.

In a post on Bluesky on 21 October, Google Search Advocate John Mueller said that if a site must go offline for an unplanned PHP update, owners should "use HTTP 503 instead of letting responses time out / 404 / 500", Search Engine Roundtable reported. He noted this can be done outside PHP, for example by pointing the domain's DNS elsewhere or serving a maintenance response from a CDN such as Cloudflare.

Why 503 matters: HTTP status codes tell search engines what is happening.

Google's own documentation on temporarily pausing a website adds more detail:

• Keep it short. Taking a whole site down should be a last resort and last only a few days at most. A 503 page is suitable for an outage of one to two days.
• For longer outages, keep an indexable home page online, returning a normal 200 status, that explains the situation.
• Do not block the site in robots.txt, and do not return a 503 for the robots.txt file itself, because that stops Google crawling the site.
• Do not add "noindex" or return 403, 404 or 410 codes, which tell Google to remove pages.
• Do not use the Removals Tool in Search Console for a temporary closure.
• After reopening, you can ask Google to recrawl key pages through Search Console or submit a sitemap.

A useful extra step is to add a Retry-After header to the 503 response, telling crawlers when to come back. Most CDNs and web servers can serve a simple 503 maintenance page without PHP running at all.

The bigger picture

PHP2Shell is one of the most serious web vulnerabilities in years because of how widely PHP is used and how little an attacker needs to exploit it. It also shows how quickly attacks now follow discovery. In this case, attack attempts were spotted days before the official fix.

It also sharpens an old problem: millions of websites run on outdated PHP versions that no longer get official security updates. For those sites, there may be no simple patch, only an upgrade.

Why it matters for India

India has a huge number of PHP websites, from small business and e-commerce stores to news portals, schools, coaching institutes and local government services, many on low-cost shared hosting.

• Small businesses often depend on their hosting company to update PHP. If you run a site, ask your host directly when the fix will be installed.
• Agencies and developers who manage client sites should check every site, including old ones running out-of-date PHP versions.
• Users should be careful with any website that suddenly behaves strangely, asks for unusual payments or redirects to other pages, which can be signs of a hacked site.

CERT-In, India's national cyber security agency, publishes advisories on serious vulnerabilities, and organisations in India are required to report certain cyber incidents to it. Website owners should watch for its guidance on PHP2Shell.

PHP2Shell is a rare case where the fix is simple, but the clock is short: update PHP now, and if you must go offline, tell Google with a 503.