PHP2Shell and AI-Built Apps: Does It Touch Your Backend?
A companion for people who build apps with AI. What PHP2Shell is, which parts of your app setup can run PHP, and what to ask before you decide it does not touch you.
Founder, Newly
Published Last updated
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a flaw in server-side PHP. The React Native and Expo app on a phone contains no PHP, so the app itself does not run the vulnerable code. Your backend might, for example a WordPress site, a Laravel API or phpMyAdmin. List the hostnames your app talks to, find which ones serve PHP, and ask each host for the fixed build.
What are the key facts?
Facts below were checked against the sources on 24 October 2026. The full incident page, with host-by-host detail, is on red.run.cloud: PHP2Shell live status and affected versions. This page covers the part that page does not: what it means when your product is an app.
| Question | Answer at 24 October 2026 |
|---|---|
| What is affected | PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed (PHP advisory) |
| Severity | CVSS v4.0 9.2 for both CVEs, remote code execution without logging in (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp) |
| Fixed versions | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 |
| Disclosed | 21 October 2026 |
| Attempts seen | AWS reported a honeypot attempt on 17 October, four days before disclosure, and says it is unclear whether such attempts would succeed on real systems (AWS) |
| CISA catalog | Neither CVE appeared in the Known Exploited Vulnerabilities listing we could read on 24 October 2026 |
Does PHP2Shell run inside my mobile app?
No. Newly builds a real iPhone and Android app with React Native and Expo, and the project code is yours to download or connect to your own repository. That code is JavaScript and TypeScript compiled into the app. PHP is a server-side language, and the PHP advisory describes installations that serve web requests.
What the app does is call servers. Every API URL in your project is a server that someone has to keep up to date. Some of those servers are run by a provider and some by you. The diagram shows the path.
Mark the PHP question per server, not per app. An app with a hosted backend and no website may have no PHP at all. An app with a WordPress landing page, a store or a PHP admin panel has at least one place to check.
Which parts of my setup can run PHP?
| Part of your setup | Runs PHP? | How to find out |
|---|---|---|
| The app on the phone | No | Nothing to check. Expo warns that EXPO_PUBLIC_ values are visible in plain text in the compiled app, so check keys instead (see the Expo docs) |
| Expo Router API routes on EAS Hosting | Not by design | EAS Hosting is built on Cloudflare Workers running V8 isolates (EAS Hosting). API routes target a WinterCG-compliant environment (API routes) |
| Supabase or Firebase | Provider-run | You cannot patch it. Read the provider's notice and check your own settings: Supabase says a table in an exposed schema without RLS is readable and writable by any role with a grant (RLS docs) |
| A server you rent | Unknown until you look | Log in and list the services running. A PHP-FPM or Apache service means yes |
| WordPress, WooCommerce, Laravel, phpMyAdmin | Yes | Ask the host which PHP build serves the domain. Updating the CMS or plugins does not change it |
| A no-code tool or plugin that hosts a page for you | Unknown | Ask the vendor in writing. Silence stays unknown |
How do I find every server my app depends on?
Build a list of hostnames, one line each. Four places hold them:
- Your project's environment files and app config. Search for values that start with
https://, such as an API base URL or a Supabase project URL. - Your DNS records. Every subdomain of your domain points somewhere, and the old ones are the ones people forget.
- Your website builder, store or blog settings, including the login page you use to edit them.
- Webhook and callback URLs configured in payment, email and analytics dashboards.
Next to each hostname write the language or product behind it. If you cannot name it, the entry is unknown and the next section applies. The list is also the base for the 15-minute check of an AI-built app, which covers keys, database rules and routes.
Response headers are hints
A header such as X-Powered-By can name PHP, and removing it is common. A missing header does not show that PHP is absent, and a version in a header does not show whether the host applied a backport. Use the host's answer.
What do I ask my host?
For every hostname marked PHP or unknown, send the same short message. The UK NCSC advises organisations to identify PHP installations, update internet-facing systems first, and check for compromise before upgrading (NCSC). Your message turns that into three answers you can file:
- Which PHP package and version serves my domain, and does it contain the fixes for CVE-2026-109618 and CVE-2026-109619?
- When did the update and the restart of PHP workers happen? Workers that were not restarted still run the old code.
- Does anything reach the origin without passing the WAF or proxy in front of it?
Hosts differ in who owns the fix. On shared plans the host usually updates PHP, and on a rented server you do. The red.run.cloud pages on what to ask your shared hosting provider and who is responsible for patching cover the wording and the split. If you build apps for clients, the agency client triage page has a way to sort sites by host.
What if PHP serves part of my app's setup?
Update PHP on every runtime that can serve web requests, then restart the workers. PHP calls updating the only complete fix. A distribution may keep an older version number while backporting the fix, so ask for the package changelog and do not compare version strings alone. Branches older than 8.2 no longer get routine updates from the PHP project, so those need a vendor build or an upgrade.
A WAF is a stopgap. Cloudflare says its rules protected free and paid WAF customers from 21 October 2026 03:02 UTC and still tells customers to patch (Cloudflare). PHP also lists temporary settings for the days before an update, including session.upload_progress.enabled=0. On 23 October 2026 PHP added an informational note that a separate issue, to be published as CVE-2026-115560, needs an unusual combination of configuration and code, and that the same setting covers it. Neither note replaces the fixed build.
Which of my app's keys could a PHP server have read?
A PHP worker runs with the access of the site it serves. If that site's config files hold the same keys your app backend uses, those keys were in reach during the window. Supabase's secret key bypasses Row Level Security and belongs only where you control the code (Supabase API keys). If you have evidence of a break-in, such as unknown admin accounts or files, rotate every key that host could read, using the rotation guide. Without evidence, record the keys as unknown exposure and move them off the PHP host. For signs to look for, see was my site exploited via PHP2Shell.
Which settings of mine matter even with no PHP?
PHP2Shell is one of several October 2026 notices. The settings below stay yours whatever language your servers run. Firebase says its Security Rules are the only safeguard blocking access for malicious users and that an app is publicly reachable once deployed (Firebase rules). OWASP lists broken object level authorization as API1:2023 and recommends tests that fail the deploy when the check is missing (OWASP API1). AI features inside your app use credits, so a route anyone can call is also a bill, which the chatbot self-test walks through.
Where do you stand?
Every item starts as unknown, because an unchecked item is unknown. A scan, ours included, cannot move PHP items to confirmed. Only the host or your own server can.
Your PHP2Shell check
- Detected: You found the problem.
- Unknown: Not checked yet, or the check could not tell.
- Confirmed by owner evidence: You checked and kept the proof.
Your answers stay in this browser tab. Nothing is saved or sent.
Frequently asked questions
My app was built with AI. Do I need to update anything in it?
Not for PHP2Shell, because the app on the phone contains no PHP. Check what your app talks to instead. Any server, website or admin tool behind it that runs PHP needs the fixed PHP build, applied by you or your host.
Does Supabase or Firebase make me affected?
Both run on the provider's infrastructure, so you cannot patch them yourself. Read the provider's own status or security notice, and keep your own focus on the key and rule settings that are yours.
I use a plugin or a WordPress site next to my app. Is that a problem?
It can be. WordPress runs on PHP, and PHP2Shell is in PHP itself, so updating WordPress or its plugins does not fix it. The PHP build that serves the site has to be updated. Ask your host which build serves the domain and when its workers were restarted.
Cloudflare is in front of my API. Can I wait?
Cloudflare says its WAF rules protected free and paid customers from 21 October 2026 03:02 UTC and also tells customers to patch PHP. A WAF is an extra layer. It does not change the PHP build behind it, and traffic that reaches your origin another way skips it.
Could my app's keys have leaked through a PHP server?
Only if a PHP site could read them. If a service role key, a Stripe secret key or an AI provider key sits in the environment or config files of a PHP host, treat it as readable by that host's PHP workers. If you have any evidence of a break-in, rotate those keys. Without evidence, the question stays unknown.
Will a scan tell me if my backend is patched?
No. A scan from outside can report a version it detects and match it to known vulnerabilities. It cannot see a backport your host applied, which PHP build serves a given hostname, or whether workers restarted. Those answers come from the host.
Sources
All sources were opened on 24 October 2026.
- PHP security advisories, October 21 and 23, 2026, php.net
- GHSA-w8hw-w9fx-j79w (CVE-2026-109618), php-src security advisories, GitHub
- GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), php-src security advisories, GitHub
- Critical security issue affecting PHP, UK National Cyber Security Centre
- Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog
- PHP vulnerabilities and WAF protection, Cloudflare blog
- Known Exploited Vulnerabilities Catalog, CISA
- Environment variables in Expo, Expo docs
- Expo Router API routes, Expo docs
- EAS Hosting introduction, Expo docs
- Understanding API keys, Supabase docs
- Row Level Security, Supabase docs
- Security Rules basics, Firebase docs
- API1:2023 Broken Object Level Authorization, OWASP API Security Top 10