PHP has released emergency updates for two critical flaws, known together as PHP2Shell, that can let an unauthenticated attacker run code on a web server.
The fixes arrived on Wednesday 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP project’s advisory. The release had been pre-announced for 14:00 UTC that day.
“All PHP users are strongly encouraged to update immediately,” the project said.
Does your business know which PHP version its website runs?
Choose an answer, then select Vote.
Two Flaws
The flaws are CVE-2026-109618, which PHP describes as “RCE via OOM corruption”, and CVE-2026-109619, “RCE via stale global state”. The project’s pre-release notice rated both 9.2 under CVSS v4.0. The Register also reports a critical 9.2 rating.
Who Is Exposed
The advisory covers all PHP installations serving web requests. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The project considers the risk highest for mod_php. There, a demonstrated exploit triggers before any application code runs.
Wiz estimated PHP powers about 70 percent of websites, Ars Technica reported.
The advisory sets out some protective settings, with a warning that “the following measures reduce exposure to specific attack paths but do not make an installation safe.” The PHP 8.5.12 release note says: “There are no complete mitigations, updating is the only safe choice.”
Linux distributions and LTS vendors received the patches in advance. PHP 8.1 and older no longer get updates from the PHP project, though some vendors provide backported fixes. PHP 8.2 reaches end of life on 31 December 2026.
The Head Start
Amazon Threat Intelligence detected an attempt to exploit PHP2Shell on 17 October, four days before the patches were released, The Register reported. The attempt was caught by Amazon’s MadPot honeypot network.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” Amazon said, according to The Register.
On 21 October Amazon detected multiple proof-of-concept exploits. The earliest came at around 0200 UTC, about 12 hours before the patches. Amazon believes this points to multiple attackers. Whether any of them would have worked against real systems remains unclear, The Register reported.
Into the Millions
Cloudflare chief executive Matthew Prince set out the numbers. Cloudflare saw thousands of exploitation attempts in the 10 hours before disclosure, tens of thousands within 45 minutes after it, hundreds of thousands within two hours, and then millions, according to The Register.
Attackers tweaked their payloads to get past Cloudflare’s firewall rules. Cloudflare deployed protections on its free and paid plans, but says they are no substitute for patching.
Security firm Hadrian reported on 21 October that most of the attacks it saw used one route. “Most of the attacks we observe abuse PHP’s session upload-progress path, and we expect more exploit paths to appear before and after the fix ships,” Hadrian said, The Register reported.
Amazon has described the flaws as “broadly exploited”, Ars Technica reported. Calif researcher Ryan Austin was more cautious. “At the moment it doesn’t look like exploitation has taken off or been widespread,” he said, according to the Guardian.
Governments and companies pulled some sites offline while they patched, the Guardian reported.
Found by Researchers and AI
Researchers at Calif and Wiz discovered the flaws with help from OpenAI and Google models, Ars Technica reported, citing the Financial Times. OpenAI worked with PHP, Calif and Wiz to verify the flaws and develop the patches.
“To our knowledge, frontier AI found these vulnerabilities before attackers did,” OpenAI said, according to Ars Technica. prw has previously covered the Senate’s call for OpenAI and Anthropic to account over rogue AI agents.
The disclosure was not smooth. The PHP Foundation accused Chainguard of publishing patched builds before the agreed disclosure deadline, The Register reported.
Patch First, Then Look Back to 17 October
The NSA told all organisations using PHP to update immediately or take systems offline, Ars Technica reported. “These vulnerabilities often provide a direct path to the server’s file system or database,” the agency said.
The UK’s National Cyber Security Centre said a hacker could take control of a website’s server without a password, according to Ars Technica.
Patching is only the first step. Amazon advises organisations to investigate suspicious activity back to at least 17 October, The Register reported. That is the date of the first attempt it saw.
The protective settings are listed in the PHP advisory. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
More security and software coverage is in prw’s Technology archive.
Sources: PHP, “Security advisory: Critical remote code execution vulnerabilities, update now”, 21 October 2026 (https://www.php.net/archive/2026.php); The Register, “Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure”, 22 October 2026 (https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749); Ars Technica, “Hackers got a four-day head start on epic PHP2Shell vulnerability”, 22 October 2026 (https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/); The Guardian, “Websites across world hit by millions of attempts to exploit PHP code flaw”, 22 October 2026 (https://www.theguardian.com/technology/2026/oct/22/websites-across-world-hit-by-millions-of-attempts-to-exploit-php-code-flaw)
Illustration: this image was generated by AI and is not a photograph of any real server, website or attack.
An unlocked padlock hangs from a chain on an old farm gate at first light. A stand-in for the PHP2Shell story: the flaws live in server software, and nothing pictured is a real website or system.
Illustration: AI-generated for PRW.
