The PHP2Shell vulnerability has forced governments and companies to take websites offline after two PHP flaws were shown to allow unauthenticated remote code execution. Cloudflare reported millions of exploit attempts on its network, while Amazon said the flaw was being broadly exploited in the wild. Patches arrived on 21 October for PHP 8.2 and newer only.
Key Takeaways
- Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10.
- Official patches cover PHP 8.2 and newer only.
- Cloudflare saw exploit attempts climb from thousands to millions.
- The UK took 32 services offline; the NCSC had no reports of successful hacks.
What the PHP2Shell Vulnerability Does
PHP, an open-source server language, powers 70% of the world’s websites, according to Wiz, which helped uncover the bugs. Tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. The BBC reported that Wiz and Calif said the flaws are inherent in the language. Computer Weekly said the bugs affect every release back to PHP 5 in 2004.
Britain’s NCSC described a vulnerability that would allow an attacker to trigger an out-of-memory condition that corrupts memory and, under certain conditions, achieve unauthenticated remote code execution. Ryan Austin of Calif told the BBC it was “the most serious vulnerability I’ve ever found”.
Computer Weekly said Wiz and Calif used AI models to locate the bugs. The BBC reported that Salil Kanhere of UNSW Sydney said: “The underlying bugs weren’t new; what changed was our ability to find them.”
Governments Pulled Sites as a Precaution
Wikimedia took down a number of its systems as a precaution until they could be patched. Finland’s Valtori took government public services offline. In the Netherlands, the National Cyber Security Centre, the Port of Rotterdam, Overheid.nl, the KNVB and several hospitals went offline. France’s Interior Ministry placed all its sites into preventive maintenance, and Orange suspended access to certain services while it deployed fixes.
Britain’s cybersecurity minister, Liz Lloyd, told parliament that 32 government services were taken offline, a move that “largely resulted from precautionary measures”. Downing Street said no public-facing critical services were affected. Edinburgh Council and BBC pages, including Doctor Who and The Traitors, went dark.
The NCSC sent 50,000 alerts to affected organisations, but said it had no reports of successful hacks as a result of the flaw. It said the scale of the vulnerability was “unprecedented”, and that the patch would not work for some organisations running older systems, and these would have to be replaced.
The BBC reported that Prime Minister Sanae Takaichi urged people to check whether public sites ran PHP. The Guardian said she encouraged businesses and organisations to patch or shut sites down.
Exploit Attempts Hit the Millions
Matthew Prince, Cloudflare’s chief executive, said attempts were already in the thousands in the 10 hours before public disclosure, and wrote on X that they had reached millions. Dane Knecht, Cloudflare’s chief technology officer, has reported “early attacks emerging,” while warning that firewall mitigations are only a stopgap.
| Period | Attempts Prince reported |
|---|---|
| 10 hours before announcement | Thousands |
| 45 minutes after announcement | Tens of thousands |
| Within two hours | Hundreds of thousands |
| By Prince’s post | Millions |
Amazon Threat Intelligence said PHP2Shell was “now being broadly exploited in the wild”. Amazon later said it was targeted in multiple attempts days before the public disclosure, but its websites were operating as normal. The Guardian reported that Ryan Austin said: “At the moment it doesn’t look like exploitation has taken off or been widespread.”
The BBC reported that, as of Friday morning, no successful attacks had been reported.
What Site Owners Should Do Now
Fixes shipped as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP Foundation said: “All PHP users are strongly encouraged to update immediately.” PHP 8.1 and older no longer receive routine security updates from the project.
The NSA said the risks are serious enough to require immediate patching across US government departments and agencies. If an immediate update is not feasible, it recommended that organisations take the system offline. CERT-EU advised considering isolation of internet-facing applications from public networks where an immediate fix is not feasible.
- Identify every PHP system, prioritising internet-facing ones.
- Confirm fixes are installed, not just scheduled.
- On PHP 8.1 or older, get a vendor backport or upgrade.
- If you cannot patch, apply the PHP team’s temporary mitigations or take the system offline.
- Check for compromise before upgrading an unpatched server.
Updating WordPress or its plugins does not update PHP. The BBC reported that Daniel Stewart of LRQA said PHP “is commonly found in the management interfaces of network appliances, load balancers, and embedded devices, which are often overlooked during these incidents.” See our Apache web server security guide; resolving WordPress plugin issues will not close these CVEs.
Visitors do not need to install PHP updates. Temporary downtime alone does not mean a website has been breached. It may reflect a protective decision, Malwarebytes reported.
