PHP2Shell: Critical PHP Flaws Draw Millions of Exploit Attempts as Sites Go Offline

The PHP project released emergency security updates on October 21 for two critical flaws that are now being attacked at very large scale. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, carry a CVSS v4.0 score of 9.2, and the project says updating is the only complete fix.

What the PHP advisory says

The primary sources are PHP's own security advisories on GitHub. The first describes a flaw in which, when PHP runs out of memory, the cleanup at the end of a request can treat half-initialised data as valid. That can lead to unauthenticated remote code execution, meaning an attacker needs no login to run commands on the server. Remote code execution was confirmed on Apache with mod_php, and the project states there is no complete mitigation short of updating.

Every common way of serving PHP to the web is affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get official releases, although minimal source backports were published for 7.4, 8.0 and 8.1 for people who build PHP themselves (BleepingComputer, Help Net Security).

PHP2Shell at a glance	Details
CVEs	CVE-2026-109618, CVE-2026-109619
Severity	CVSS v4.0 9.2 (critical), no authentication needed
Fixed releases	8.5.12, 8.4.27, 8.3.36, 8.2.35
Older branches	Source backports only for 7.4, 8.0, 8.1
Affected setups	PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed

How fast the attacks grew

Cloudflare chief executive Matthew Prince posted escalating counts: thousands of exploitation attempts in the hours before the announcement, tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and then millions (The Next Web). These are attempts, not confirmed breaches, and it is not yet clear how many succeeded (The Next Web).

Amazon Web Services says attacks began before the public disclosure, with proof-of-concept exploits seen on October 21 roughly 12 hours before the patches shipped (The Register). Palo Alto Networks counted more than 22.6 million internet-exposed instances that may be vulnerable (TechTarget).

Found with AI, twice

The discovery story is part of why the incident is drawing attention. An employee of security firm Calif used OpenAI's GPT-5.6 Sol model, through OpenAI's Patch the Planet programme, to find the flaw, and Google-owned Wiz says it identified the same problems independently, also with help from AI tools (SiliconANGLE). The discovery dates reported by different outlets vary slightly, and the PHP project has not published its own account of the timeline.

Who has been hit

So far the reporting describes precautionary shutdowns rather than confirmed breaches. Finland and other European governments took some websites down as a precaution, and banks, airlines and rail operators in Japan suspended online services the following day (BetaNews). Germany's BSI says it has seen attacks but no successful use of the flaws, and the Dutch national cyber agency says it has no indication of active misuse (The Next Web).

WordPress and the scale of exposure

PHP is the server-side language of roughly three quarters of websites whose language is known, according to W3Techs, which explains why a flaw in the language itself spreads so widely. Because the bug is in PHP rather than in any app, WordPress, WooCommerce, Magento, Drupal, Joomla and Laravel sites are all exposed until the runtime is updated. Self-hosted WordPress owners must update PHP on their own servers; a WordPress core update will not fix it.

What site owners should do

Check which PHP version your server or hosting provider runs, and move to one of the four fixed releases for your branch. Shared hosting customers should ask the provider whether it has updated, since they cannot patch the runtime themselves. Anyone still on PHP 8.1 or older should treat the backports as a stopgap and plan an upgrade. Because exploitation began before the fix, review server logs from before October 21 for unusual requests that ended in memory errors.

India

We found no advisory from India's CERT-In and no confirmed Indian outage at the time of writing. PHP and WordPress are widely used by Indian businesses, start-ups and government departments, so the same patch advice applies here, and Indian hosting customers should confirm their provider has moved to a fixed release.

What to watch next

Watch for PHP's full technical write-up, any confirmed list of compromised organisations, and whether hosting providers report unpatched servers still online.

Related on Gadgets365

• Microsoft's October Patch Tuesday sets a record at about 1,400 fixes, including a Windows zero-day
• Microsoft's last 2026 Secure Boot certificate expires: what unpatched PCs lose
• RatHat: new Android malware uses live AI to steal bank logins