Governments, universities, hospitals, and tech companies took websites offline this week after two critical flaws in PHP2Shell were disclosed. PHP is the server-side language behind WordPress, Drupal, Joomla, Magento, and Wikipedia’s MediaWiki. Security researchers say the flaws could let an outside attacker take over a server without logging in. The fixes were released on October 21, 2026, but many servers were still unpatched when attacks began to rise.
What the flaws are
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security team rates both at CVSS v4.0 9.2 and says they can allow unauthenticated remote code execution. One early circulating version listed a score of 10.0, which PHP says was wrong.
Both flaws sit in PHP’s core engine, not in any single application. CVE-2026-109618 involves out-of-memory errors. If a request hit PHP’s memory limit at the wrong moment, PHP could leave partly initialized data behind and later treat it as valid, corrupting memory. CVE-2026-109619 is a stale-state flaw: a fatal error could leave internal state pointing to memory from a previous request, which a later request on the same worker could reuse.
Wiz, one of the firms that found the bugs, said the flaws could also leak sensitive data from server memory, including passwords, tokens, API keys, and certificates belonging to other requests. Wiz demonstrated pre-authentication code execution on current WordPress, Drupal, and Joomla container images. Its position is that the flaws are in PHP itself, so even a simple “Hello World” app on a vulnerable version can be exposed.
Which systems are at risk
Wiz says every PHP version released in the last decade is affected by at least one of the bugs, reaching back to PHP 5.4. The PHP Foundation’s advisory lists fixed releases of 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 7.4 through 8.1 received no official release, only minimal source backports for people who build from source. Older branches, PHP 5.4 through 7.3, received no fix from the project.
The scale of exposure is a matter of counting method. Censys found about 1.5 million of 2.6 million hosts reporting PHP were running a version with no fix. Nextgov reported that Censys had counted about 39.7 million internet-accessible services reporting affected versions, including about 12.8 million in the United States. Those figures count services, not individual websites.
The “70%” figure that circulated widely comes mainly from Wiz, and the BBC says it could not verify it. Usage trackers give different numbers: W3Techs says PHP is used by 69.3% of websites whose server language it can identify, while Reuters cites roughly 75% on the same basis.
Why the fallout was so fast
The sequence matters because it shows how the disclosure went wrong. Researchers at Calif reported an unconditional code-execution flaw on August 11, and OpenAI and Wiz later reported the same root cause. The PHP Foundation says the first signs of the memory problem appeared in 2024, during an external audit.
Then the embargo broke. On October 20, the CVE identifiers spread on forums and social media with the wrong release time and the wrong severity score. PHP moved its release up one day, to October 21. Calif also mistakenly published a video that showed its proof of concept working against several targets. The Foundation says this helped accelerate public proof-of-concept code. Chainguard published built images containing the fix more than six hours early, which let anyone study the patch in binary form.
Attackers started before the public release. Amazon’s security team saw an exploitation attempt against a decoy system on October 17, four days before disclosure, from an anonymous address. It did not say how the attacker learned of the flaws. Amazon now says the flaws are “being broadly exploited in the wild.”
Cloudflare CEO Matthew Prince reported that the company saw thousands of attempts in the 10 hours before the announcement, tens of thousands within 45 minutes after it, hundreds of thousands within two hours, and millions by the following day. Cloudflare says it had deployed web application firewall rules ahead of disclosure and offered them to all customers, including the free tier. It calls them a stopgap, not a fix.
Government and institutional shutdowns
The shutdowns were mostly precautionary, and they varied by country.
- United Kingdom: Tech minister Baroness Lloyd told the House of Lords that 32 government services were unavailable and four were partially unavailable. She said this “has largely resulted from precautionary measures.” Officials said they were not aware of any confirmed compromise of central government systems. The Office for Budget Responsibility was among the offline sites, days before the Budget.
- Netherlands: The national cybersecurity agency took its own site offline. Overheid.nl, the Port of Rotterdam, the national football association, and the websites of the country’s five largest political parties were also among those affected.
- Finland: State IT provider Valtori shut down public-facing central government web services.
- Sri Lanka: Researcher Dr Hattotuwa found that 80 state-linked websites were running vulnerable PHP versions between October 22 and 24. Of those, 61 used versions that no longer receive security fixes.
- United States: The NSA advised organizations to take systems offline if they could not update.
- Wikipedia and other platforms: The Wikimedia Foundation said it had taken some systems down until they could be patched safely. Automattic said hosted WordPress.com and Tumblr users were safe. Risk was higher for small sites on shared hosting, where customers do not manage the server.
What remains unknown
Experts disagree about how fast the threat will develop. Lukasz Olejnik of King’s College London warned that “with AI, exploitation may happen instantly.” But a Hacker News report said that attackers who tried to recruit infected systems into a Mirai botnet variant called Potassium had failed, and that no shell access had been found on any screened site as of October 22. Sri Lanka’s count showed no confirmed successful exploitation as of Friday. The reasons for this gap are not yet clear.
Wiz and OpenAI describe the AI role as central. Wiz says frontier models helped turn a long-standing flaw into a working exploit, and that a single researcher completed in a week what previously would have taken a world-class team months. These are vendor claims that independent reviewers have not yet tested. The PHP Foundation said the problem was partly a human one: the security team stalled on choosing among competing fixes, each with trade-offs, and it said the delay was “a structural failure.”
For site operators, the practical message is clear. The PHP Foundation says updating is the only complete fix. Its advisory lists temporary settings that reduce exposure, including memory_limit=-1 for CVE-2026-109618, and session.upload_progress.enabled=0 plus fatal_error_backtraces=0 on PHP 8.5 for CVE-2026-109619. It says workers must restart after these changes, and that they do not make an installation safe.
