PHP vulnerability PHP2Shell: why sites went dark and what to do

PHP2Shell lets an outside attacker run their own code on a web server without logging in. Both flaws carry the identifiers CVE-2026-109618 and CVE-2026-109619, and each scores 9.2 on the CVSS version 4 scale, the industry’s 10-point severity rating.

The two bugs share a root cause. When a request to the server ends in an unusual way, PHP can leave its memory in a broken state, and an attacker can use that mess to slip in instructions. One flaw abuses how PHP recovers when it runs out of memory. The other abuses leftover data from an earlier request that should have been wiped but wasn’t.

Here is the part that worries experts most. The weakness sits in PHP itself, not in any website’s code. So a site can be carefully written and still be exposed, because even a bare test page running on a vulnerable PHP version can be attacked. Researchers also showed an attacker can read memory from the server process, which may hold passwords, login tokens and API keys belonging to other visitors.

Every PHP setup that answers web requests is affected, according to the PHP security team. That covers PHP-FPM, php-cgi, FrankenPHP, LiteSpeed and Apache running mod_php. The team rates mod_php as the highest risk, because a working exploit there fires before any of the site’s own code even starts.

The reach goes back a long way. Several of the research firms put the oldest vulnerable release at PHP 5.4, which covers more than a decade of versions. VirusTotal estimates more than 5.1 million PHP hosts are exposed to the internet.

The patch was meant to arrive in an orderly way. PHP warned administrators a day early and set the release for 14:00 UTC (10 a.m. ET) on October 21, with wider details due on October 22. Then details leaked online, a proof-of-concept attack began circulating, and the clock sped up.

Governments told people not to wait. The UK’s National Cyber Security Centre urged British organizations to update anything running PHP or pull it offline until they could. CERT-EU gave similar advice, and the US National Security Agency issued its own alert.

• BambooHR took its service offline in the US, Canada and Ireland and warned customers that payroll would be interrupted.
• Laravel paused its Cloud deployments while it rebuilt on patched images.
• OBS, the GrapheneOS forum and Pinboard pulled parts of their sites down.
• In the Netherlands, the DigiD login service and several government and school systems went offline as a precaution.

Cloudflare switched on firewall rules for every customer, free accounts included, about nine hours before disclosure. Its chief technology officer, Dane Knecht, said the company was already seeing early attacks and called the rules a stopgap. As of the morning of October 21, no successful break-in had been confirmed, and watchTowr, which reproduced one flaw, had seen no attacks in the wild.

The flaws were found by researchers at Calif, Wiz and OpenAI. Calif spotted the first one in August during a code audit funded by OpenAI, with help from OpenAI’s GPT-5.6 Sol model. Wiz says it found the flaws independently weeks later, using its own tools plus models from Google and OpenAI.

OpenAI presents this as proof that AI can find huge flaws before criminals do, and says it expects similar findings to rise sharply in the coming months. Calif was more cautious. It said it used only publicly available models, and that knowing PHP’s history mattered more than the AI. The uncomfortable flip side is that the same tools are available to attackers.

If you only browse the web, there is nothing to install. The fix happens on servers. But it is a good week to stay alert:

• Watch for breach notices from services you use, and change that service’s password if you get one.
• Expect some sites to be slow or briefly down while they patch.
• Turn on two-factor login wherever you can, so a stolen password alone isn’t enough.

If you run a website, even a small WordPress blog, check your PHP version today. Updating WordPress or a plugin does not touch PHP. The runtime comes from your web host, your server packages or your container image.

1. Install the October 21 security release for your branch: PHP 8.5.12 on the newest branch, or the matching new builds of 8.4, 8.3 and 8.2.
2. Restart Apache, PHP-FPM and any long-running PHP workers so the fix actually loads.
3. On Linux distribution packages, check the changelog for the two CVE numbers, since a patched package can keep an old-looking version number.
4. On a shared host, open a support ticket and ask whether your plan is patched.

Older branches need extra care. PHP 8.1 and earlier no longer get official updates, though the PHP team published bare-bones source fixes for 7.4, 8.0 and 8.1. PHP 8.2 itself reaches end of life on December 31, 2026, so it is worth planning a move to a newer branch now.

Before the patch, a configuration change, turning off session upload progress, spread online as a workaround. The PHP team now says it only blocks some attack paths and does nothing for the other flaw. PHP core developer Gina Peter Banyard warned that patching is the only real defense.

Temporary steps, like setting a fixed memory limit and lowering the maximum upload size, can reduce risk for a server that truly can’t be updated yet. Treat them as a bandage. After you patch, keep an eye out for odd signs of an earlier break-in, such as repeated server errors, unusually large session cookies or PHP workers restarting for no clear reason.