PHP2Shell: what happened, and why our apps were never at risk
· Security · PLAYCODE3
On October 21, the PHP project shipped emergency fixes for two critical flaws nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10). PHP is the programming language behind a large share of the web, from blogs to online stores. These flaws let an attacker run their own code on a server just by sending it a specially made request, with no password needed, and security teams saw attacks start within days. Hosting companies emailed their customers to update right away, and software makers posted notes saying whether they were affected. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and there is no setting that works around the problem: updating is the fix.
We checked everything the same day. None of our apps or websites use PHP: Screenplay Assistant and playcode3.ai run on JavaScript and Python, our servers have no PHP installed, and our code has no PHP files. So there was nothing to patch, and our apps were never exposed to these flaws. We also checked with the outside services we rely on, and we keep watching. If you run a website on PHP, update it today.
Read more
These links go to other sites.
- PHP's official security release (php.net) (php.net, opens in a new tab)
- News coverage: PHP2Shell, update now (helpnetsecurity.com, opens in a new tab)
- Operational guidance from a national cyber security centre (github.com, opens in a new tab)