PHP2Shell: Critical PHP Flaws Push Governments to Take Websites Offline

Governments, public bodies and companies around the world have taken websites offline after two critical flaws in PHP, the programming language behind a large share of the web, were disclosed alongside emergency fixes on Wednesday, 21 October 2026. The vulnerabilities, nicknamed “PHP2Shell” and tracked as CVE-2026-109618 and CVE-2026-109619, can allow an unauthenticated attacker to run code on a vulnerable web server, according to the US Cybersecurity and Infrastructure Security Agency (CISA).

Security firms reported a surge of scanning and exploitation attempts within hours of the disclosure. CISA, the UK’s National Cyber Security Centre (NCSC) and counterparts in the EU, Australia and Japan have urged organisations to patch immediately, and to consider taking systems offline if they cannot.

What Is PHP2Shell?

PHP2Shell is the name given to two memory-safety bugs in PHP: CVE-2026-109618, a memory corruption issue, and CVE-2026-109619, a use-after-free flaw. Each carries a CVSS v4 score of 9.2 out of 10, according to Tenable. CISA says the vulnerabilities “allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests”.

Tenable lists common server set-ups as affected, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed. The BBC reported that CERT-EU said the flaws could affect versions dating back to PHP 5, released in 2004.

• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Older branches: PHP 8.1 and earlier are end-of-life; users depend on vendor or Linux distribution backports, or need to upgrade.
• Severity: CVSS v4 9.2 for each flaw (Tenable).
• CISA advice: patch now; take unpatched or unsupported PHP systems offline; use a web application firewall as a stopgap.

How Were the Flaws Found, and Why Was Disclosure Rushed?

The bugs were discovered by researchers at security firms Calif and Wiz, who used advanced AI models, the BBC reported. Calif and the PHP Foundation took part in an OpenAI programme called Patch the Planet, and OpenAI said one of its own researchers found the issue around the same time. Wiz called them the “most severe vulnerabilities ever discovered” by AI and estimated that “roughly 70%” of the internet is affected, a figure the BBC said it could not verify.

The PHP Foundation had planned a later coordinated release, but details leaked online on Tuesday, 20 October, forcing an earlier announcement, according to the BBC and SecurityWeek.

Is PHP2Shell Being Exploited?

Amazon said its honeypot sensors recorded a first exploitation attempt on 17 October, while the bugs were still under embargo, and that “PHP2Shell is now being broadly exploited in the wild” after public proof-of-concept code appeared. Cloudflare chief executive Matthew Prince said attempts across its network grew from thousands before the announcement to “millions now”, SecurityWeek reported.

Other researchers struck a more cautious note. WatchTowr said many circulating exploits “either don’t work at all, test for timing-based differences, or crash the target”. CISA said in its 21 October alert that it had not observed exploitation at the time of publication, and the flaws had not been added to its Known Exploited Vulnerabilities catalogue as of 23 October.

The exposure is large. Censys counted roughly 1.57 million unpatched, internet-facing hosts reporting a PHP version on 21 October, and VulnCheck estimated that at least 1 million run end-of-life PHP versions, SecurityWeek reported.

Which Websites Have Gone Offline?

According to the BBC and a Reuters factbox, organisations that took sites down as a precaution include Finland’s government web services provider Valtori, the Dutch NCSC itself, the Netherlands’ public-health institute RIVM, the Port of Rotterdam and the Dutch football association KNVB. Denmark’s municipal IT body Kombit shut services including a school-communications platform. The Wikimedia Foundation took “a number of other systems” offline as a precaution.

Services are expected to return once updates have been applied and checked.

What Should Website Owners Do Now?

For most site owners, especially those running WordPress, Drupal, Joomla or Magento on shared or managed hosting, the key step is to confirm that the hosting provider has upgraded PHP to a fixed version. WordPress plugin and core updates do not change the server’s PHP version, so a fully updated WordPress site can still be exposed.

• Check your PHP version in your hosting control panel or in WordPress under Tools > Site Health > Info > Server.
• Ask your host to confirm PHP has been upgraded to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a patched vendor build.
• Move off PHP 8.1 or older where possible.
• Turn on web application firewall protection if available.
• Look for warning signs such as unexpected admin users, new files or PHP processes starting shells.

It is also a good moment to tighten account security. Our guide to passwords, passkeys and two-factor authentication explains how to protect admin logins if a server is ever compromised.

Featured image: data centre server racks (November 2015), by Carl Lender / Wikimedia Commons, CC BY 2.0. Illustrative file photo.

Sources

• CISA — Critical Vulnerabilities in PHP Require Immediate Patching (21 October 2026).
• Tenable — php2shell (CVE-2026-109618, CVE-2026-109619): Frequently Asked Questions (21 October 2026).
• BBC News — Websites taken down worldwide as critical cyber-security update issued (21 October 2026).
• SecurityWeek — PHP2Shell Exploitation Started Days Before Patches (22 October 2026).
• AWS Security Blog — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure (22 October 2026).
• Investing.com (Reuters) — Factbox: Governments, companies take websites offline over PHP flaws (21 October 2026).