PHP 'PHP2Shell' flaws prompt global patching blitz and infrastructure shutdowns

Millions of exploit attempts detected; governments report no confirmed breaches yet but warn of potential pre-disclosure exploitation.

By LineZotpaper

Published23 October 2026

Read Time3 min

Two critical vulnerabilities in the PHP programming language, collectively dubbed PHP2Shell, have triggered emergency patching across the internet. Fueled by millions of exploit attempts logged by Cloudflare and evidence of pre-disclosure scanning detected by Amazon, the flaws, which allow unauthenticated remote server takeover, have forced governments and major online services to take systems offline.

PHP released security updates on October 21 to address the two flaws, CVE-2026-109618 and CVE-2026-109619. A patch is only effective once installed and the web server restarted, leaving the network of websites that rely on PHP, approximately 70 per cent of those with a known server-side language, in a heightened state of risk.

Exploit attempts have been prolific. Cloudflare CEO Matthew Prince said his company's network observed thousands of attempts in the 10 hours before the disclosure, a figure that rose into the millions soon after. Amazon CISO CJ Moses reported that its decoy servers logged an attempted exploit on October 17, four days before the public announcement. "It remains unclear how the actor acquired exploit information prior to disclosure," Moses said, adding the vulnerabilities are "now being broadly exploited in the wild."

Despite the intensity of scanning, no successful compromises have been officially confirmed. Germany's federal cybersecurity agency, BSI, represented by vice president Thomas Caspers, said it observed attacks but no successful exploitation, noting the flaw "seems a little bit more complicated than expected to exploit." Japan's Chief Cabinet Secretary Minoru Kihara similarly stated no attacks have been confirmed.

The patch delay drew criticism from the PHP Foundation itself. In a statement, it admitted to spotting the underlying issue in 2024 but struggling to decide on a fix, calling the delay "a structural failure, caused by both the security team's decision process and its lack of resources." The team has since shifted from a consensus-based to a majority-vote model.

In the interim, the UK's National Cyber Security Centre advised organisations to take systems offline if they could not be patched immediately. Services affected included Wikimedia projects, Orange's apps across dozens of countries, 32 UK government services, Dutch hospitals, and Germany's federal IT provider, ITZBund. Some, like the UK's Office for Budget Responsibility, have since returned online. Others, such as the Dutch crime-reporting site Meld Misdaad Anoniem, remained offline on Thursday.

Security firm Mallory identified roughly 884,000 internet-facing hosts running PHP versions that will receive no official fix, leaving them exposed. Amazon has advised defenders to treat October 17 as the earliest known exploitation date. No crypto exchange has yet reported a breach linked to PHP2Shell, but users are urged to verify website authenticity, particularly when connecting wallets.

Analysis

Why This Matters

The vulnerability potentially affects the backbone of a vast portion of the web, not just a single service.
The response highlights the fragility of open-source security, where widely used software depends on small, under-resourced teams.
With millions of probing attempts already logged, the window for data theft is wide open, even if the exploit is currently non-trivial to execute.

Background

PHP2Shell comprises two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the PHP scripting language. They allow an unauthenticated attacker to seize control of a vulnerable server. The flaws were patched on October 21. The PHP Foundation revealed it first found signs of the problem in 2024 but failed to ship a fix promptly due to organisational indecision and resource constraints, a breakdown it described as a "structural failure".

Key Perspectives

The PHP Foundation: Admitted to a "structural failure" in its security process. It is planning to move from a consensus-based to a majority-vote system to expedite fixes. The foundation stressed that the security of the software the web runs on depends on a tiny team. Security Vendors (Cloudflare, Amazon): Observed massive, sustained exploitation attempts. Amazon's finding of a pre-disclosure attempt on October 17 raises significant questions about information leaks. Both advise defenders to assume a greater timeline of risk. National Cyber Agencies (BSI, Japan): Reported no successful exploitations confirmed as of Thursday, suggesting the exploit may be difficult to reliably execute, though this offers cold comfort given the potential for late discovery of breaches.

What to Watch

Whether the pre-disclosure scanning activity on October 17 is linked to a known threat actor.
Patch rates among the roughly 884,000 vulnerable hosts identified by Mallory.
The first confirmed data breach or ransomware deployment tied to a PHP2Shell exploit, which could materialise weeks after the fact.

Sources

Is the Internet Safe Again After the PHP Nightmare? What You Need to Know · Decrypt

Checked

12 claims in this story checked against 1 source: 6 supported.

Show each claim

Partly supportedThe headline says the flaws prompted a global patching blitz and infrastructure shutdowns.Decrypt: “A day after sent governments scrambling to unplug their websites, the fix is out”
Not in the sourcesThe story says the vulnerabilities “allow unauthenticated remote server takeover.”Decrypt: “the two flaws, nicknamed PHP2Shell, let a stranger take control of a vulnerable server without logging in.”
SupportedThe vulnerabilities “are now being broadly exploited in the wild.”Decrypt: “adding that PHP2Shell is "now being broadly exploited in the wild."”
SupportedCJ Moses said, “It remains unclear how the actor acquired exploit information prior to disclosure.”Decrypt: “"It remains unclear how the actor acquired exploit information prior to disclosure," Amazon CISO CJ Moses”
Partly supportedThe story says governments warn of potential pre-disclosure exploitation.Decrypt: “Amazon went further, saying its decoy servers logged an attempt on October 17, four days before the bugs went public.”
Partly supportedThe flaws triggered emergency patching across the internet.Decrypt: “PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday”
SupportedThe flaws allow an unauthenticated person to take control of a vulnerable server.Decrypt: “the two flaws, nicknamed PHP2Shell, let a stranger take control of a vulnerable server without logging in.”
Partly supportedCloudflare’s attempts rose into the millions soon after disclosure.Decrypt: “hundreds of thousands within two hours, and millions since.”
SupportedAmazon’s decoy servers logged an attempted exploit on October 17, four days before public disclosure.Decrypt: “Amazon went further, saying its decoy servers logged an attempt on October 17, four days before the bugs went public.”
SupportedGermany’s BSI observed attacks but no successful exploitation, and Japan had confirmed no attacks exploiting the flaws.Decrypt: “Thomas Caspers, vice president of Germany's federal cybersecurity agency BSI, said the agency had seen attacks but no successful use of the flaws”
SupportedThe vulnerabilities “seems a little bit more complicated than expected to exploit.”Decrypt: “"It seems a little bit more complicated than expected to exploit."”
Partly supportedThe vulnerabilities have forced governments and major online services to take systems offline.Decrypt: “The UK's told organizations to consider "taking the system offline until it can be fully mitigated."”