PHP2Shell vulnerability: attacks, outages and warnings so far
Where the PHP2Shell vulnerability stands: what each government advises, which firms report attacks, and why a bug seen in 2024 stayed unfixed.
Why it matters
PHP runs most of the web, so any unpatched server can become a way in for attackers. Sites that have not updated yet are now the main target.
Attackers are now exploiting the PHP2Shell vulnerability, a pair of critical flaws in the PHP web programming language patched on 21 October 2026, security firms say. Palo Alto Networks’ Unit 42 reported one break-in at a European government body.
The intruders reached password hashes and multi-factor login secrets within two hours, Unit 42 said on 23 October, and used AI agent tools once inside.
PHP is the language behind 69.2% of websites whose server-side code is known, according to web survey firm W3Techs, WordPress sites among them. The two bugs, CVE-2026-109618 and CVE-2026-109619, let a stranger run commands on a web server without logging in. PHP’s security team scored each 9.2 out of 10.
How far attacks have gone is still disputed. The US Cybersecurity and Infrastructure Security Agency (CISA) said it had not seen a successful exploit when it issued its alert, and neither flaw was in its catalog of known exploited bugs as of 23 October.
Two memory bugs inside PHP itself
Neither flaw is in WordPress or any other app; both sit in the PHP engine. One is triggered when PHP runs out of memory partway through setting up a request. The other leaves data pointing at freed memory, which the next request on the same worker process can pick up, according to PHP’s advisory. A demonstrated exploit against Apache’s mod_php fires before any application code runs.
Fixes came in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Branches 7.4, 8.0 and 8.1 got only source patches. Our guide to checking your PHP version and patching walks through each hosting setup.
A bug first spotted in 2024
The PHP Foundation’s own account, published on release day, explains why a flaw this old took so long. In 2024, during PHP’s first external security audit in years, carried out by Quarkslab with money from the Sovereign Tech Agency, a core developer noticed the first signs of the out-of-memory problem. Nobody found a concrete attack. The security team also could not agree on a repair, because each candidate either broke compatibility, created a denial-of-service risk or forced changes on thousands of third-party extensions.
The foundation calls the delay “a structural failure, caused by both the security team’s decision process and its lack of resources.” It says such decisions will now be made by majority.
Outside researchers forced the issue. Security firm Calif began auditing PHP on 30 July 2026 and on 11 August reported a working remote attack with the same root cause, the foundation says. Calif used OpenAI’s GPT-5.6 Sol model, and cloud security firm Wiz found both bugs independently, Decrypt reported. OpenAI said AI appeared to find the bugs before attackers did.
How a leak pulled the release forward
- 20 Oct 2026, about 15:00 GMT: The CVE numbers leak online with a wrong severity score of 10.0. PHP moves its release from 22 to 21 October.
- 20 Oct, about 20:00 GMT: Calif mistakenly posts a video of its exploit working against real targets. Copies spread after it is deleted.
- 21 Oct, 07:41 GMT: Chainguard publishes software images containing the fix more than six hours early, which the foundation says “disregarded weeks of work” on a coordinated release.
- 21 Oct: PHP ships the fixes; CISA, the FBI and the UK’s National Cyber Security Centre (NCSC) issue warnings.
What governments told site owners to do
The advice converges: update now, and if you cannot, take the site offline or cut it off from the internet.
| Country or body | Main advice |
|---|---|
| United States (CISA, FBI, NSA) | Patch now; take PHP systems offline if you cannot update or still run PHP 8.1 or older |
| United Kingdom (NCSC) | Update; use PHP’s temporary settings; consider going offline if those take too long; check for backdoors |
| European Union (ENISA, CERT-EU) | Act immediately; isolate exposed applications if patching cannot happen at once |
| Japan (Prime Minister Sanae Takaichi) | Check for PHP and install the patch; temporarily suspending sites can reduce risk |
| Australia (ACSC) | Find PHP systems, prepare to patch, monitor for malicious activity |
Source: CISA, NCSC, ENISA, Associated Press, Jiji Press, Sky News, 21 to 23 October 2026.
Many took their own advice. Reuters listed precautionary shutdowns at Germany’s federal IT provider ITZBund, French prefecture websites, Belgium’s foreign ministry, Finland’s state IT center Valtori and the Port of Rotterdam. The Wikimedia Foundation, which runs Wikipedia, also took down a number of systems.
Attempts by the million, one reported break-in
| Who | What they reported | When |
|---|---|---|
| Amazon Threat Intelligence | An attempt on its decoy systems before disclosure; later called the flaws “broadly exploited” | 17 to 21 Oct |
| Cloudflare | CEO Matthew Prince said there were “millions” of exploit attempts within hours | 21 to 22 Oct |
| watchTowr | Attempts against both flaws, none successful at the time | 21 Oct |
| CISA | No successful exploitation observed at publication | 21 Oct, revised 23 Oct |
| Palo Alto Networks Unit 42 | Break-in at a European government body; password hashes reached within two hours | 23 Oct |
Source: ABC News, Associated Press, SecurityWeek, CISA, Unit 42, Tenable.
Why the clean-up will take years
A hosting platform patches PHP once for thousands of customers. The hard cases are servers nobody remembers running. W3Techs counts 26.8% of PHP websites on PHP 7 and 7.7% on PHP 5, branches with no official fix, and Unit 42 counted more than 22.6 million exposed instances that may be vulnerable.
PHP also hides inside products few people think of as websites. Cisco lists its Expressway video gateways and Duo Access Gateway as affected, with eight more product lines under investigation, and the UK NCSC tells organizations to watch for updates to appliances that bundle PHP.
Old PHP bugs have a record of living on. CISA’s catalog of exploited flaws already lists PHP bugs from 2012, 2019 and 2024, and it says two of them have been used in ransomware campaigns. Calif traced the oldest affected code in PHP2Shell to PHP 5.4.0, released on 1 March 2012, Tenable reported. Charl van der Walt of Orange Cyberdefense told the AP it could take “months or years before all the stragglers are weeded out.”
The foundation’s diagnosis is less comfortable than the AI headlines. Machines found the bug quickly; the lost time came from a human decision and a thinly staffed team, which has published 15 security fixes since July while sorting more than 100 invalid or duplicate reports. It is asking hosting firms and governments, several of which spent last week unplugging their own sites, to pay for that work.
What happens next: PHP says its next regular bugfix release will fix the third issue, CVE-2026-115560, and suggests turning off session upload progress until then. PHP 8.2 stops getting security fixes on 31 December 2026. Watch whether CISA adds PHP2Shell to its exploited-bugs catalog, which would set a federal patch deadline for US agencies.
