PHP2Shell PHP vulnerability patch: the PHP project has released emergency fixes for two critical flaws that let attackers execute code on web servers without logging in.
Technology / Cybersecurity — both bugs score 9.2 out of 10, every PHP installation serving web requests is in scope, and the only complete fix is the update itself
What happened, in order
On Tuesday, October 20, the PHP security team did something it rarely does: it announced a critical release in advance. Two vulnerabilities, both rated 9.2 out of 10 under the CVSS v4.0 scoring system, would be fixed in a release scheduled for 14:00 UTC on Wednesday, October 21, and users were told to prepare to update immediately. The advance warning itself was a signal of severity — and it became necessary because the secret was already out. Details of the flaws had leaked ahead of a planned October 22 disclosure, circulating on the Hacker News forum and social media, and the security firm watchTowr publicly confirmed the vulnerabilities were real. Proof-of-concept material and partial write-ups began appearing before the embargo lifted.
The patches duly landed on Wednesday, slightly ahead of schedule, in four branch releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive releases from the project; the team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source or rely on a long-term-support vendor, and distributions received fixes in advance. Anything older than that gets nothing official at all. The PHP team's instruction was unambiguous: updating is the only complete protection. Temporary configuration changes can narrow specific attack paths, but, as PHP core developer Gina Peter Banyard put it in remarks reported by BleepingComputer, no mitigation fully blocks the attacks — the patch is the only permanent defense.
The two flaws, explained plainly
Both bugs are memory-safety flaws in how PHP handles a web request that ends abnormally, and both end at the same place: remote code execution, meaning an unauthenticated attacker — someone with no account and no password — can run their own code on the server with the privileges of the web worker account.
CVE-2026-109618 works through out-of-memory corruption. If a request runs out of memory partway through being set up, PHP can be left holding half-initialized request data, and the cleanup that follows can treat that corrupted data as valid — a chain of weaknesses an attacker can steer into executing code. CVE-2026-109619 is a stale-global-state flaw: internal state from one request can survive in memory past its proper lifetime and be picked up by a later request handled by the same worker, enabling a heap use-after-free, disclosure of server memory — which can hold passwords, authentication tokens, API keys and certificates, Wiz warns — and again remote code execution.
The scope is what elevates this from a bad bug to an internet event. PHP says every installation that serves web requests is potentially affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all named. The risk is highest on mod_php, where PHP demonstrated an exploit that fires from a single unauthenticated request before any application code runs — in plain terms, before the website itself gets a chance to do anything at all. Wiz says every PHP release back to 5.4 is hit by at least one of the two bugs. The flaws had, by the researchers' account, been sitting in the code for years; what changed is that they were finally chained into working exploits.
Why this matters
Start with the denominator. W3Techs' widely cited measurement puts PHP behind about 69 percent of websites; BleepingComputer puts the figure at 75 to 80 percent; USA Today's guidance to readers used three-quarters. The estimates differ because they count differently, but every serious count lands in the same place: PHP is the default machinery of the ordinary web — the small-business site, the school portal, the clinic booking page, the local newspaper, the government form. A critical flaw in a single popular application is a fire in one building. A critical flaw in PHP is a fault in the material most buildings are made of.
Second, the flaw is in the layer nobody sees. A site can have perfect code, diligent plugin updates and strong passwords, and still be fully exposed, because the vulnerability sits underneath all of that in the language runtime. That inverts the usual security advice. The person who owns the website often cannot fix this at all: on shared hosting, PHP belongs to the host. Security firm Wordfence's guidance, reported in gaming-press coverage of the outages, boiled down to one task for site owners: find out who manages PHP on your server. Millions of site owners woke up on Wednesday dependent on an update only someone else could install for them.
Third, the discovery itself marks a shift. The flaws were found and reported by researchers at Wiz, the Google-owned cloud security company, which says it identified both bugs, and by the security firm Calif working with OpenAI's Patch the Planet program; OpenAI says Calif identified a critical flaw using its GPT-5.6 Sol model, and describes the bugs as among the most impactful security issues in recent memory. Wiz's researchers said frontier AI models substantially reduced the barrier to turning a longstanding, dormant flaw into a working exploit — work that took about a week where a human team might have needed months. That cuts both ways, and the researchers said so: the same capability that found these bugs for the defenders is available to attackers hunting the next ones. PHP2Shell is therefore two stories at once — a patching emergency, and an early demonstration that the economics of finding catastrophic bugs in old, ubiquitous code have changed.
Governments chose darkness over risk
The most visible consequence on Wednesday was not a hack. It was an absence. Following advisories from CERT-EU and Britain's National Cyber Security Centre — both of which told organizations that could not patch fast to consider taking systems offline — public websites went dark across Europe as a precaution. The Netherlands saw the widest disruption: the national cyber security centre took its own website offline, joined by the DigiD login service, the MijnOverheid citizen portal, the House of Representatives, the government portal Overheid.nl, the Port of Rotterdam, the KNVB football association, the websites of major political parties and several hospitals. A single Dutch vendor's decision to shut down took the portals of roughly a hundred public bodies offline with it.
Finland's state IT provider Valtori pulled government public-facing web services offline, stressing that the outage was a precaution and not the result of a breach. France's Interior Ministry took its websites down. Denmark's municipal IT provider Kombit shut services including the national school communication platform. Germany's federal IT provider ITZBund took several sites offline, and in Britain, councils and the Metropolitan Police were among those pulled offline after the NCSC alert. Beyond government, the Wikimedia Foundation shut down many supporting services, the forums 4chan and Something Awful went offline, the esports wiki Liquipedia went down, privacy group noyb withdrew its site, Belgian media group DPG Media took sites offline, and parts of Japan's internet — including the games Umamusume: Pretty Derby and Shadowverse: Worlds Beyond and online commerce sites — went dark as well. In the United States, the National Security Agency recommended that websites unable to update immediately go offline temporarily.
That collective decision deserves a moment's thought, because it was not panic — it was arithmetic. With a demonstrated exploit, leaked details, attack traffic already probing, and a patch that did not exist until Wednesday afternoon, keeping a vulnerable public service online meant accepting a real probability of compromise to avoid a certain few hours of downtime. Agency after agency did the same calculation and chose the downtime. The episode is a useful stress test of how much of the public internet runs on a single language runtime and a small number of upstream vendors: one vendor's shutdown in the Netherlands silenced a hundred public bodies that had each done nothing wrong.
What the numbers actually say
The exposure estimates vary by who is counting, and they should be read as a range rather than a single figure. VirusTotal estimates cited by BleepingComputer count more than 5.1 million PHP hosts exposed online, about 3.8 million of them with at least one port open. Palo Alto Networks counted more than 22.6 million internet-exposed instances that could be vulnerable — a much larger number, because it counts instances rather than hosts. Both can be true at once; what they agree on is the order of magnitude: millions of systems, on day one, with exploit code already circulating.
The other number that matters is the legacy tail. Roughly half of PHP sites run older versions, according to experts quoted by The Record — and PHP 8.1 and older receive no official release at all. For that half of the web, Wednesday's patch was not a download; it was a migration project, a vendor negotiation, or a decision to stay exposed. The history of comparable events is not reassuring on this point: Log4Shell, the 2021 Java logging flaw that PHP2Shell is already being shelved beside (Wikipedia's article links the two, along with Heartbleed), remained exploitable on unpatched systems for years. The realistic forecast is a fast patch wave among professionally run hosts this week, and a long, quiet tail of forgotten servers that scanners will keep finding — and probing — for a long time.
Attempts are confirmed; successful break-ins are not
Precision matters here, because the exploitation picture on Wednesday was genuinely contested. Cloudflare said it observed early attack traffic before the patches were released, watched attackers mutate payloads to evade its rules, and pushed emergency firewall rules live for all customers, free and paid, at 03:02 UTC on Wednesday — roughly nine hours ahead of disclosure — while stressing the rules were a stopgap, not a substitute for patching. watchTowr said its honeypot network was observing in-the-wild exploitation attempts, with junk proof-of-concept traffic bearing "php2shell" user-agents; its head of threat intelligence, Jake Knott, added the important qualifier: "Whilst nobody has been successful to date, we don't expect that will last long." Against that, the U.S. Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of Wednesday, Huntress and the Dutch NCSC likewise reported none seen, Tenable said it could not verify that circulating exploit code actually works, and neither flaw had been added to CISA's known-exploited list. Insurance Business, summarizing the day, put it plainly: no successful break-ins had been confirmed as of Wednesday afternoon.
The honest reading is that attempts are real and documented by the networks positioned to see them, while confirmed successful compromises are, so far, zero in the public record. Those two facts are compatible: most early traffic in events like this is automated probing and copycat proof-of-concepts, much of it broken. But the window is measured in hours, not weeks — Sansec expected mass attacks to begin within 15 minutes of the patch release, because a public patch tells attackers exactly where the flaw lives, and every unpatched server becomes easier to find from that moment. Security researcher Kevin Beaumont called it "one of the biggest vulns in years." Wiz went further: "among the most severe vulnerabilities discovered in PHP, and arguably in software history."
What site owners need to do — and what everyone else should do
If you run a website, the checklist is short and non-negotiable. Find out which PHP version your server is actually running — not which version you think it is running. Update to the fixed release for your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Then restart every PHP worker, because a patch that is installed but not loaded protects nothing. If you are on PHP 8.1 or older, there is no release waiting for you: ask your host or vendor about backported fixes, apply the project's source backports if you build PHP yourself, or treat an upgrade to a supported branch as the emergency it now is. If you cannot patch and cannot take the site offline, the temporary configuration steps PHP published — including disabling session upload progress and, on PHP 8.5, fatal-error backtraces, each followed by a worker restart — narrow specific attack paths only. PHP is explicit that they do not make an installation safe. Updating WordPress, a theme or a plugin does not touch this flaw at all.
If you are an ordinary internet user, USA Today's guidance is the right calibration: there is not much you need to do, and the main risk to you is indirect. Stick to trusted sites, be suspicious of unexpected emails or messages claiming to come from sites you use — outage confusion is prime phishing material, and fake "mirror" sites and fake "security patch" downloads were already being warned about in gaming communities on Wednesday — turn on two-factor authentication for important accounts, and keep your browser and operating system updated. If a site you have an account on later discloses a breach, change that password. And if a government or gaming site you use is simply down today, this is most likely why: it is a precaution, not necessarily a compromise.
What happens next
Three things will decide how this story is remembered. The first is patch velocity in the next 48 hours: professionally hosted sites should mostly be fixed quickly, and every hour of delay is worth more to attackers than the last, because working exploits improve as they are tested against the newly public patch. The second is the first confirmed compromise — if and when a real breach is attributed to PHP2Shell, the story changes from a near-miss drill to an incident with victims, and the contested exploitation claims of Wednesday will be re-read in that light. The third is slower and larger: whether the discovery method — AI systems chaining decade-old memory bugs in the world's most common web language into working exploits — turns out to be a one-off or the start of a run of similar disclosures in other aging, ubiquitous codebases. OpenAI has already said its program found further significant vulnerabilities still being repaired. Site owners should plan on Wednesday's drill not being the last of its kind.
For now, the state of play is simple enough to state in one breath: the flaw is critical, the patch exists, the attacks probing for it are real, no successful break-in is confirmed, and the only action that settles the matter for any given server is the update. Everything else — the firewall rules, the settings changes, the precautionary darkness across Europe — is buying time to do exactly that.
Related coverage: When the hackers are AI agents: the Cairn and Norforge cases · France supermarket cyberattack: the Danfoss fridge incident
Sources
BleepingComputer, "PHP ships emergency patches for critical PHP2Shell flaws," October 21, 2026 — bleepingcomputer.com. The Register, "PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched," October 21, 2026 — theregister.com. The Hacker News, "PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge," October 21, 2026. Help Net Security, "PHP2Shell: Critical PHP vulnerabilities patched, update now!," October 21, 2026. USA Today, PHP vulnerability live coverage and reader guidance, October 21, 2026. Wikipedia, "PHP2Shell" (accessed October 21, 2026), for the consolidated impact list. PHP project security announcements via php.net, October 20–21, 2026. CERT-EU and UK National Cyber Security Centre advisories, October 21, 2026.