PHP2Shell: why the internet is on fire today, and why PixelUnion is not affected

If you work anywhere near a web server, today is not a quiet Wednesday. Two critical vulnerabilities in PHP, nicknamed PHP2Shell, leaked online before the PHP team could ship a fix. Admins all over the world are now waiting for a patch that is scheduled for 14:00 UTC today, with attackers waiting right alongside them.

Short version for PixelUnion users: your photos are not at risk. The longer version is below.

What PHP2Shell is

PHP2Shell is the name for two flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on the CVSS v4.0 scale. That rating means an attacker can run their own code on a vulnerable server without logging in. In practice: send the right request to a website, get a shell on the machine behind it. Hence the name.

The exact root cause has not been published. Researchers suspect a memory bug (a so-called use-after-free) in the part of PHP that handles file uploads, but that is not confirmed yet, and at least one audit disputes it. What is confirmed: the security firm watchTowr says it reproduced one of the two bugs and that “these vulnerabilities are indeed real.” Which PHP versions are affected is also still unclear. Early claims say everything back to PHP 5.4, and PHP has not published an official range.

Why the internet is burning today

Three things make this one worse than the average security bulletin.

First, reach. PHP runs roughly three quarters of all websites whose server language is known. WordPress, most webshops, countless hosting panels and forums all sit on top of it. A remote code execution bug in PHP itself, not in one plugin or one app, touches an enormous part of the web at once.

Second, the leak. Normally a fix ships first and the details follow later, which gives defenders a head start. This time the details got out before the patch. The workaround that went around first, disabling PHP’s upload progress feature, turned out to be incomplete. So there was a period where everyone knew the door was open and nobody had a lock.

Third, the patch itself becomes a map. Once fixed versions are public, attackers can compare old and new code and see exactly what changed. The security firm Sansec expects mass exploitation within about 15 minutes of the release. On top of that, scans show roughly 884,000 internet-facing servers still advertise PHP 8.1 or older. Those branches are end of life and will likely never get a fix.

So today a lot of people are watching a release page, ready to upgrade the moment it goes live. Some of them will not make it in time.

Why PixelUnion is not affected

PixelUnion runs on Immich, and Immich is not written in PHP. The server is TypeScript running on Node.js, with a separate machine learning service in Python. There is no PHP interpreter anywhere in the path between your phone and your photos. A bug in PHP’s upload handling cannot be triggered on a server that does not run PHP.

To be complete: we did run one small peripheral service on PHP. It sat outside the photo platform, on separate infrastructure, and had no access to your library. We did not want to bet on an unknown patch arriving in time, so we shut it down before the release window. It stays off until we have verified a fixed version.

None of this means we think we are immune to security problems. Every stack has bugs, ours included. What matters is knowing exactly what runs where, keeping the attack surface small, and acting fast when something like this lands. That is the work, and we keep doing it.

If you run your own PHP sites, check the PHP security announcements and patch as soon as the release is out. If you are looking for a place for your photos that is built with this kind of care, we would be glad to have you.

Start free with PixelUnion →

Cover photo by Ricardo Gomez Angel on Unsplash.