The weakness
Two serious flaws in PHP’s memory handling can let a specially crafted web request make the server run someone else’s instructions—even without a login. The nickname is php2shell. [2]
GVPH learning hub / PHP handbook
A little know-how.
A safer digital day.
Heard about the PHP attack? Let’s make sense of it—one small lesson, one video, and one “what would you do?” at a time.
No tech background needed. No downloads. No real attacks.
A peek behind the webpage
example.org
“Please show this page”
PHP
The behind-the-scenes helperRuns on the website’s server
The risk starts here, in vulnerable server software.
Let’s unpack it.Three small activities. A clearer next step.
0 of 3 explored01 / The 60-second version
First, what is PHP?
Think of a website as a front desk. PHP can be one of the helpers behind it: preparing pages, handling forms, or talking to a database. It usually works on the server, not inside your browser. [1]
The possible harm
An attacker could read information, change files or disrupt a service within the access the PHP process has. Application credentials or connected data may be at risk. That is a possible consequence, not proof of a breach. [4]
The useful response
Owners need verified software or vendor updates. Staff need a simple way to spot concerns and report them. A website containing PHP does not, by itself, mean it has been attacked. [3]
Activity 1 / Go behind the scenes
Follow a suspicious request.
A pretend website. Three steps. Select each one to see where the problem can happen.
THE REQUESTIllustration only
A webpage starts with a request.
Normal requests ask to open a page or submit a form. An attacker can send a deliberately unusual request to try to trigger a weakness.
You do not need to click an attacker’s email for a public server to receive a request.
A conceptual demonstration, not a working exploit. Technical basis: CERT-EU advisory and PHP permission model.
It’s more than a website question
Where might PHP be hiding?
These are places to check—not a list of confirmed vulnerable products. A web interface alone does not prove PHP is present. Exact models, software builds and vendor advice matter. [3]
Websites & portals
Some content systems, forms, shops and web applications use PHP.
Ask: the website owner or hostStorage & appliances
Some NAS devices and business appliances bundle PHP in their control panel.
Ask: IT or the device vendorNetwork control panels
Some edge and network products have a PHP-based management interface.
Ask: the network administrator02 / Watch it click
Two short videos. No jargon marathon.
Original GVPH illustrations with synthetic narration, English captions and full text alternatives. Press play when you’re ready.
The big picture
Behind the webpage
See how a request can become a problem—and why permissions matter.
Read the full transcript
PHP is software that runs behind some websites and device management pages. Think of it as part of the engine, working behind the screen.
An attacker sends a specially crafted request to a reachable, unpatched PHP service. The weakness is in the server software, not in a person opening an email.
Certain memory handling flaws can let that request make the server run commands. Some attacks do not require a login.
An attacker may reach site files, stored information, or application credentials. The reach depends on the app's permissions and the system's configuration.
Finding PHP does not prove an attack happened. Visiting a website does not automatically infect your computer.
Owners need official updates, limited management access, and a check for signs of compromise. A patch closes the weakness. It does not erase an earlier break-in.
Illustrative explanation based on PHP, CERT-EU and PHP security guidance.
Your next step
Spot it. Pause. Report.
A calm response beats a rushed click. Learn what belongs with you and what belongs with IT.
Read the full transcript
If a site suddenly asks for unusual logins, downloads, or personal information, stop. Do not keep entering information just to see what happens.
Note the page address, the time, and what changed. Report it to your I.T. team or service provider using a trusted contact.
Do not try exploit tests or download an unapproved fix. Do not turn off shared clinical systems yourself. Let the responsible team coordinate.
Owners should inventory websites and devices, then verify the actual PHP or firmware version. Install the matching update from the official vendor or hosting provider.
Limit who can reach management pages. If compromise is suspected, preserve evidence and have the response team check for persistence.
Use tested backups and multifactor authentication as extra protection. They help recovery and account security, but they do not replace patches.
Activity 2 / Your turn
What would you do?
No trick questions. Pick a response and see why it helps. All situations are fictional.
At your desk
“Install this urgent security fix.”
A familiar website suddenly asks you to download a tool to protect against PHP attacks. You weren’t expecting it.
Practice for everyday decisions. A suspicious prompt is not proof of php2shell. Reporting guidance
03 / Make it useful
A small plan for your role.
Choose the guidance that fits. Check items as you read; nothing is saved or sent.
You don’t have to diagnose the attack.
Your job is to pause, capture the basics and get help through a trusted route.
A calm check beats an urgent click.
Keep your devices current and contact the organization through a route you already trust.
Inventory. Update. Verify.
Check the actual runtime serving each site and the firmware of each appliance.
Open the GVPH scannerAuthorized inventory only. A scan does not certify safety.
Prevention and response sources: NCSC-NL, NIST, IHS and NCSC. Learning checkmarks reset when you reload.
Activity 3 / Myth or useful fact?
Give your instincts a quick check.
Choose an answer for each statement. You can change your mind—this is practice, not a test.
01
“The padlock means the website’s PHP is patched.”
02
“An unknown PHP version needs follow-up.”
03
“Installing the patch removes any attacker already there.”
Three ideas worth remembering.
Why these answers matter: HTTPS, hidden PHP, incident response.
Keep this bit for your IT team
What “updated” means right now.
Reviewed October 26, 2026 · A dated guide, not a live security feed.
The table is the upstream baseline for the two original php2shell flaws. Vendor package revisions and follow-up advisories also matter. Confirm the current guidance before making a change. [2] [10]
| PHP branch | Original fixed baseline |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
Older upstream branches are unsupported. Some vendors backport fixes into older-looking version numbers. Obtain explicit confirmation for the installed package; do not rely on its number alone.
October 23: an additional configuration advisory
PHP recommends administrators disable session.upload_progress.enabled until the next regular bugfix release, with worker restarts. The follow-up, CVE-2026-115560, involves an unusual combination of session configuration and application behavior. Keep this separate from the two original fixes and follow the full official instructions. Read PHP’s October 23 notice.
October 26: updated Windows packages
Windows rebuilds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 address a separate Brotli issue, CVE-2026-111497. The displayed PHP runtime version does not change. Verify the installed package, not just a header. Read PHP’s October 26 notice.
Why a scan can’t always tell you the PHP version
Servers can hide their version, and proxies may answer for them. DNS identifies addresses, not the PHP build or its patch status. Ask the administrator to verify the runtime serving the exact site and any vendor backport. Do not publish a diagnostic page to reveal it. PHP’s hiding guidance.
Do temporary workarounds make it safe?
They can reduce specific attack paths, but they are incomplete. Use vendor or PHP guidance while arranging a verified update. Do not copy server configuration changes from this learning activity. CERT-EU recommendations.
Tiny glossary
Five words, translated.
- Vulnerability
- A weakness in software.
- Exploit
- A way of using that weakness.
- Remote code execution
- Making another computer run instructions from a distance.
- Patch / firmware update
- A software repair, sometimes bundled into a device update.
- Compromise
- Someone has gained unauthorized access or control.
04 / Show your sources
Learn from the people closest to it.
Technical facts come from the PHP project and security authorities. The fictional scenarios and animations are GVPH learning examples, not evidence of an incident at GVPH or elsewhere.
- PHP project · What PHP doesServer-side software and how pages are produced.
- CERT-EU · Security advisory 2026-018Scope, severity, original fixed releases and response recommendations.
- NCSC-NL · php2shell operational informationLiving vendor inventory and product-specific update links. Check the exact product.
- PHP project · Filesystem securityWhy the permissions of the server process limit—or widen—possible impact.
- PHP project · Hiding PHPWhy missing version information cannot prove a system is safe.
- NIST · Recognizing and reporting phishingTrusted contact routes and handling suspicious requests.
- Indian Health Service · Updating your softwarePractical advice for installing trusted updates.
- UK NCSC · Responding to active exploitationInvestigation and recovery beyond installing a patch.
- Canadian Centre for Cyber Security · Safer browsingWhat HTTPS does and does not tell you.
- PHP project · October security noticesOctober 21 original flaws, October 23 follow-up and October 26 Windows rebuilds.
The reviewed advisories describe critical flaws and public exploit demonstrations. They do not establish that every PHP system is compromised or that widespread exploitation has been confirmed. This page is educational; it does not scan your device or collect your answers.
The bit to take with you
Pause. Report. Let the right people patch.
You don’t need to become a security expert to make a safer choice.
What does that AI word mean?
Search 20 plain-language terms and try three everyday decisions.
Explore the glossary →Next / Public health preparednessConnect the dots. Practice a plan.
Explore outages, AI, weather and the essentials communities depend on.
Try the preparedness activities →