PHP2Shell Vulnerability: Millions of Attacks Hit Sites

The PHP2Shell vulnerability has triggered millions of exploit attempts in just a few days, as attackers race to hit unpatched websites before their owners can update. If you run a website, this is one update you should not postpone.

What Is the PHP2Shell Vulnerability?

PHP is one of the oldest and most widely used programming languages for building websites. It runs behind blogs, online shops, company portals, and government services — estimates put it behind roughly 70% of all websites. That is why a flaw in PHP itself, rather than in one company's product, is such a big deal: it can potentially touch millions of servers at once.

Image: The PHP Foundation

PHP2Shell is the name given to two flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 on the CVSS severity scale, and both allow what security experts call unauthenticated remote code execution. In plain English: an attacker can run their own code on a vulnerable server without needing a username or password. That is about as serious as a website flaw gets.

The bugs are memory-safety errors in how PHP handles fatal failures, particularly when it runs out of memory. Because the problem lives in the language itself rather than in a plugin or a theme, even a simple website on an affected version can be exposed. Researchers demonstrated the attack against WordPress, Drupal, and Joomla sites, but the flaw affects all PHP installations serving web requests, going back as far as PHP 5.

How Millions of Attacks Unfolded in Hours

The timeline of this story is what makes it remarkable. The PHP Foundation released emergency fixes on Wednesday, October 21, covering PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with source backports for older versions 7.4 through 8.1. But details of the flaws had already leaked before the planned disclosure date, and the release was pulled forward by a day. One research firm even briefly posted a video showing the exploit in action.

Attackers moved at machine speed. Cloudflare chief executive Matthew Prince shared the numbers from Cloudflare's network: thousands of exploit attempts in the 10 hours before the public announcement, tens of thousands within 45 minutes of it, hundreds of thousands within two hours, and millions soon after. Amazon's cloud division said the flaws are now being broadly exploited in the wild, and its threat-intelligence team had spotted an attempted attack as early as October 17, four days before the patch release.

Most of what researchers see so far is scanning — attackers knocking on doors to find unpatched servers — rather than confirmed mass break-ins. But reports of successful exploitation remain conflicting, with some security vendors reporting confirmed compromises and post-exploit activity by late Friday, October 23. Millions of knocks is a lot of warning either way.

Why Patching Is Lagging Behind

Fixing the flaw itself is simple: update PHP. The hard part is reaching every server that needs it. Governments, banks, airlines, and hospitals across Europe and Asia temporarily took services offline as a precaution while they patched. Japan's Ministry of Finance and National Tax Agency suspended some online services, telecom operator Orange restricted access to some of its PHP-based sites, and Finland's Valtori blocked public government services while installing patches.

But the long tail of the internet patches slowly. Fresh reporting on October 24 found more than 21,000 Danish websites still lacking PHP security updates, and South Africa's Presidency website remained offline as a precaution, with a spokesperson telling Reuters there was no indication of a breach. Smaller organizations often have no dedicated security team and depend on hosting providers to apply updates, while systems running older, unsupported PHP versions may need bigger upgrades first.

The blast radius keeps widening into vendor products too. Palo Alto Networks confirmed on October 24 that the flaws affect its PAN-OS and Panorama management interfaces, rating the product impact 8.7 out of 10, with fixed hotfixes arriving between October 26 and 30. Until then, the company advises restricting management-interface access to trusted addresses only.

What Website Owners Should Do Now

If you run a website, here is the practical checklist:

• Update PHP immediately to a fixed version: 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on your branch. There is no complete workaround — the PHP Foundation says updating is the only safe choice.
• Restart your web services after updating, including Apache, PHP-FPM, and any long-running PHP processes, so the patched build is actually the one serving traffic.
• If you cannot patch yet, take the site offline or restrict access to trusted addresses. The NSA, CISA, and FBI all gave the same advice: patch now, or pull the plug until you can.
• Check for forgotten PHP installations. PHP can hide inside content management systems, hosting control panels, and third-party products you may not realize are running it.
• Ask your hosting provider whether your server has been updated, if you do not manage the server yourself.

What This Means for Everyday Internet Users

If you only browse the web, this flaw does not directly attack your laptop or phone — it targets the computers that run websites. But the sites you use could be affected, which is why the patching race matters to everyone. A compromised website can have its content changed, its visitors' data stolen, or malware planted for the next visitor.

For now, the sensible steps are the usual ones: use unique passwords, turn on two-factor authentication wherever it is offered, and keep an eye out for unusual account activity on sites you use often. You cannot patch someone else's server, but you can limit the damage if one of your accounts is caught up in a breach.

The Bigger Picture: AI Is Speeding Up Both Sides

PHP2Shell is also a story about how artificial intelligence is changing security. The flaws were found with help from AI research tools: a researcher at security firm Wiz asked an AI agent to test whether a weakness found in WordPress also worked against Drupal, and the agent instead flagged a flaw in PHP itself that had gone undetected for more than a decade. Separately, researchers at Calif, working with OpenAI, found a related flaw.

The same acceleration applies to attackers. Once a flaw is public, AI-assisted tools can turn it into working exploits in hours, and the gap between disclosure and mass exploitation is collapsing from weeks to days. OpenAI chief executive Sam Altman has said he no longer thinks humanity will be able to patch all bugs. Security firm Tenable has classified PHP2Shell as a Vulnerability of Concern, its highest rating, comparing its potential impact to Log4Shell, the 2021 flaw that shook the internet.

That is the real lesson of PHP2Shell. The flaw will be patched, site by site, but the race it exposed — between AI-powered discovery and the slow grind of updating millions of servers — is only getting faster. For more on the threats shaping the web, see our latest cybersecurity news and technology updates.

Sources: AI Agent Update, Zot News, Cybersecurity News