⬇ Download holy card: ·
Saint PHP2Shell, Scourge of Half the Web
Patron of servers running PHP without knowing it, never-updated WordPress sites, and embargoes that don't hold.
Life
On 21 October 2026 the PHP project released fixes for two deep flaws in the language engine, CVE-2026-109618 and CVE-2026-109619: mishandling of out-of-memory errors left corrupted state that the next request could reuse, up to unauthenticated code execution. Among the independent discoverers, Wiz Research demonstrated RCE against WordPress, Drupal and Joomla. News of the flaws leaked the day before the patch, and the first exploitation attempts arrived within hours; the name comes from an exploit tool called PHP2Shell.
Prayer
O Saint PHP2Shell, who enters the engine of half the web, let our PHP be updated before the embargo leaks. Amen.
How to celebrate
Celebrated by updating PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and discovering with surprise how much still runs on PHP.
Leave PHP old and you leave the house open.