PHP2Shell: the PHP flaw that pushed governments, ministries and web giants to pull their sites offline

Two critical flaws found in the core of PHP, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), triggered one of the biggest emergency responses the web has ever seen this week. The PHP security team announced them on Tuesday, October 20, 2026, and shipped an urgent fix the next day. Both let an attacker run code on a server without so much as a user account. The fallout was immediate. In France, the Interior Ministry, the national weather service Météo-France, the tax portal and the city of Toulouse all switched to maintenance mode. Italy, Brazil, Germany and Japan saw the same reflex. Here is what happened, what php.net actually said, and where the patching effort stands.

One thing needs saying up front, because it has been all over social media: no, “every website in the world” did not get hacked. Most of the outages were deliberate. Administrators chose to close shop for a few hours rather than leave a vulnerable server exposed while they installed the patch. A site in maintenance mode is not a hacked site. The risk, though, was very real.

What php.net announced, step by step

The official timeline comes down to two posts on the project’s website.

On October 20, the PHP security team published a fairly understated pre-announcement. A security release would ship on Wednesday, October 21 at 14:00 UTC (4 p.m. in Paris and Rome, 10 a.m. in New York). It would fix two critical vulnerabilities scored 9.2 on the CVSS v4.0 scale, and everyone was told to get ready. The notice added that the team reserved the right to bring the release forward if details leaked or attacks appeared. That line was not there for decoration.

On October 21, at around 13:35 UTC, slightly ahead of schedule, four versions landed at once: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They came with a bulletin titled, bluntly, “Critical remote code execution vulnerabilities, update now”. The project’s message could not have been clearer. Updating is the only safe option, and no configuration setting offers full protection.

The bulletin includes several details that matter:

• every PHP installation that answers web requests is affected, whatever the execution mode: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed;
• the risk is rated highest with mod_php, where a working attack was demonstrated before any application code even runs;
• Linux distributions and long-term support vendors received the fixes ahead of time;
• PHP 8.1 and earlier no longer get official updates, but given the severity, the team published minimal fixes as source code for PHP 7.4, 8.0 and 8.1;
• the community repository rpms.remirepo.net, widely used on Red Hat, AlmaLinux and Rocky Linux servers, would not be updated on release day. PHP therefore advised its users to switch to their distribution’s packages or build from source.

Finally, the bulletin lists temporary mitigations for anyone who cannot update right away, while stressing that they reduce exposure without making an installation safe. We cover them in detail in our practical guide (see below).

Two flaws, one weak spot: memory management

Without going deep into the guts of the Zend engine, the two flaws can be summed up like this.

CVE-2026-109618: when PHP runs out of memory at the worst moment

PHP caps the memory each request can use (the well-known memory_limit). The first flaw exploits what happens when that cap is hit right in the middle of setting up a request. PHP stops while some internal data is only half built. The cleanup phase then walks over that data and treats it as if it were valid. That is memory corruption, and a skilled attacker can turn it into code execution.

The chilling part: memory exhaustion can be triggered from outside, with a crafted file upload request (a “multipart” form). No account needed, no password needed.

CVE-2026-109619: leftovers from a previous request

The second flaw is sneakier. A modern PHP server does not spin up a new process for every visitor. It keeps “workers” alive that handle one request after another. Normally each request starts from a clean slate. Here, though, part of a request’s internal state can survive after the memory holding it has been freed. The next request handled by the same worker can then use those leftovers before they get reset. Specialists call this a “use-after-free”, a class of bug listed as CWE-416 by the Canadian Centre for Cyber Security in its alert.

According to the technical advisories published on GitHub, two attack paths are confirmed: the file upload progress tracking feature (session.upload_progress), which is on by default, and on PHP 8.5, backtrace output on fatal errors (fatal_error_backtraces).

Think of it this way. A waiter never fully clears the table between two parties. The next guest finds a forgotten order slip and, by filling it in cleverly, gets the kitchen to serve whatever they want.

Flaws that go back a long way

The most worrying part is their age. According to the analysis published by Google Cloud, every PHP version from 5.4 up to 8.5.11 is vulnerable. In other words, code that has been sitting there for more than a decade. The watchTowr lab confirms that abandoned branches, PHP 5 included, are affected.

Why “PHP2Shell”, and how the story leaked

The nickname comes from the researchers: the flaw lets an attacker get a “shell”, meaning a command line on the target server. Credit for the discovery goes to the team at Calif, who worked with OpenAI and AI tools over the summer. The timeline pieced together by the PHP Foundation puts the report to the PHP security team on August 11, 2026, with OpenAI identifying the same root cause on its own that same day. Researchers at Wiz then found further variants and demonstrated attacks on WordPress, Drupal and Joomla in a test environment.

Coordinated disclosure was scheduled for Thursday, October 22. It did not hold. On the morning of October 20, a post on Hacker News announced the existence of two code execution flaws in PHP. By the afternoon, the CVE identifiers were circulating. That evening, the PHP team moved the release up to the 21st. And according to the PHP Foundation, one company (Chainguard) published images early on the morning of the 21st that already contained the fix, which made it possible to compare the code before and after and work out the flaw ahead of the official release.

The foundation has also publicly admitted to delays: hints of the problem dated back to an audit carried out in 2024, although no concrete attack scenario had been demonstrated at the time.

The role AI played in this discovery is significant. We already covered this shift with GPT-6 Astra, the OpenAI model that crossed a critical threshold in cybersecurity: the same tools that help researchers find flaws can also cut down the work for attackers.

In practice, what can an attacker do with PHP2Shell?

The technical phrase is “unauthenticated remote code execution”. Put simply, someone who sends the right requests to your server can make it run their own instructions, with the permissions of the PHP process. From there, everything depends on your setup, but the list of possible damage is long:

• theft of the database (customers, orders, addresses, hashed passwords);
• harvesting of API keys stored in configuration files (payments, email delivery, cloud services);
• planting a backdoor that stays active even after the update;
• defacing pages, injecting malicious scripts, redirecting visitors to scams;
• using the server to mine cryptocurrency or attack other sites.

The second flaw adds another risk: leaking data held in memory, which can include session tokens or application secrets. That is why many experts recommend rotating sensitive keys afterwards, even if there is no visible sign of intrusion.

Why all the panic? Because PHP runs most of the web. According to W3Techs, on October 21 it was detected on 69.3% of websites whose server-side language is known. WordPress, WooCommerce, Drupal, Joomla, PrestaShop, Magento, Moodle, most shared hosting plans and a host of admin panels are built on it.

The sites taken offline: a country-by-country list

No complete, verified count exists. Here is what authorities, media outlets and the organisations themselves documented between October 20 and 22.

France: ANSSI recommends pulling the plug

France saw the most visible response. ANSSI, the national cybersecurity agency, recommended taking affected servers offline until the patch was installed, and counted more than 600,000 servers running PHP on the French internet. At its request, the Interior Ministry put all of its exposed sites into “preventive maintenance”.

Among the sites that went dark on Wednesday, October 21:

• the websites of the préfectures (the state’s regional offices), which pushed their updates out through social media and printed notices;
• the website of the Paris Police Prefecture;
• Météo-France;
• the tax portal, still in maintenance on the morning of Thursday the 22nd;
• the website of the city and metropolitan area of Toulouse, which was still showing a maintenance page the next day.

Plenty of people found out that week that their tax return or their préfecture appointment depended on a programming language they had never heard of.

Italy: GARR, town councils and a CSIRT alert

In Italy, the GARR consortium, which runs the national research and education network, announced on October 21 that it had isolated some of its platforms as a precaution while it applied the fixes. The town of Montemurlo, in Tuscany, suspended its portals and several management applications that same afternoon. CSIRT Italia, part of the National Cybersecurity Agency (ACN), issued an alert bulletin that was picked up by CSIRT Toscana among others.

Elsewhere in Europe

According to Reuters, government websites were taken down in Germany, the Netherlands, Belgium, Finland and the Czech Republic, with municipal, school and hospital services affected in several countries. The United Kingdom and Denmark were also among the countries named by the French press. On the hosting side, Germany’s Netcup took its hosting plans offline while it patched, and Uberspace went as far as disabling PHP from 15:45 on October 21. The Wikimedia Foundation shut down some tools used by volunteer developers, without taking Wikipedia offline.

The Americas and Asia

In Brazil, the Federal Regional Court of the 1st Region suspended external access to its SEI document management system, as did the Court of Accounts of the State of Tocantins. In the United States, ICANN temporarily disabled some services and the NSA called for an immediate update. In Japan, hugely popular platforms such as niconico and pixiv went into maintenance just before the patch came out, according to the site Gigazine.

Have the attacks actually started?

Yes, attempts have been seen. Cloudflare said it saw malicious traffic targeting these flaws from the morning of October 21, before the patch was even out, along with repeated tweaks to the requests designed to slip past its filters. The watchTowr lab says it observed real-world exploitation from the 21st through its honeypot network. As of October 22, however, the US agency CISA had not yet added the two flaws to its Known Exploited Vulnerabilities catalog.

What nobody knows yet is how many sites were actually compromised. No one has published a reliable tally, and you should be wary of eye-catching numbers. What scanning engines measure is exposure. According to Censys, around 1.5 million out of 2.6 million hosts were showing a PHP version with no fix available, and some 884,000 exposed servers were still running PHP 8.1 or older on October 20. Those forgotten servers, which no official update will ever rescue, are the biggest worry for the weeks ahead.

How the world is patching

The fix plays out at three levels: the Linux distributions that build the packages, the hosting companies that install them, and the protection services that filter traffic in the meantime.

Linux distributions

Ubuntu published its USN-8948-1 advisory on October 21, with fixes for releases 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS. Watch out for a classic trap: Ubuntu ships the fix without changing the main version number. A patched Ubuntu 24.04 still reports PHP 8.3.6. What changes is the package number (8.3.6-0ubuntu0.24.04.13). Debian 13 offers PHP 8.4.27 in its security repositories, while Debian 12 was still waiting for an advisory when we checked. Red Hat, Rocky Linux, Fedora and Amazon Linux have published their own bulletins. And Ondřej Surý’s repository (sury.org), very popular on Debian and Ubuntu, backported the fix all the way to PHP 5.6, which spared a lot of administrators a panicked migration.

Hosting companies

Most of the big hosts put out statements during the day on the 21st. A few examples:

The o2switch case, checked by Clubic, shows the nuance well: a host can have temporary protections in place while still running older binaries a few hours after the patch is released. Protected does not necessarily mean patched.

Cloudflare and web application firewalls

Cloudflare switched on dedicated PHP2Shell rules at 03:02 UTC on October 21, including for sites on the free plan. CloudLinux, which powers many shared hosting servers running cPanel, did the same through its Imunify360 firewall, with one notable limitation: its rules block the public attack on Apache servers but only log it on LiteSpeed. Everyone keeps saying the same thing: a firewall is a layer of protection, not a fix.

WordPress: no update coming

One point caused a lot of confusion. WordPress.org confirmed that no WordPress core update is planned, since the problem sits in PHP, underneath WordPress. Updating your plugins and theme is still good practice, but it does not fix PHP2Shell.

Cybersecurity agencies on high alert

Rarely has a single flaw set off so many alerts at once. The US agency CISA called for immediate patching on October 21. The UK’s NCSC recommended updating or taking PHP offline. CERT-EU published its advisory 2026-018, ENISA a joint European statement, and the Canadian Centre for Cyber Security its alert AL26-026. The Australian and Japanese agencies passed on the same message. In France, ANSSI went as far as recommending that unpatched servers be shut down, which explains the scale of the maintenance outages across government services.

What you need to do, in short

If you run a website, the question is not “am I affected?” (you are, if you use PHP). It is “who has to apply the patch?”.

• On shared or managed hosting, it is your host. Check its status page or ask it directly whether the October 21 patch is installed.
• On a VPS or dedicated server, it is you. Update the PHP packages, then restart PHP-FPM or Apache.
• On PHP 8.1 or older, plan a migration to a supported version, after first checking whether your distribution or host provides a fix.

We have put together a step-by-step guide for freelancers, small online stores and brochure sites: PHP2Shell: how to protect and update a small website.

What about your computer, is it protected?

Let’s be honest: no antivirus on your PC will fix a flaw that lives in PHP, on a server. That job belongs to the update, and the update alone. But crises like this one come with a second wave, far more mundane and just as effective. In the days that follow, scammers send fake emails “from your host” or “from the cybersecurity agency” (ANSSI in France, the NCSC in the UK, CISA in the US) urging you to “apply the patch” through a booby-trapped link, or to download a so-called checking tool. And the computer you use to manage your site holds exactly what an attacker wants most: your FTP and SSH access, your admin passwords, your API keys.

That is where an up-to-date security suite earns its keep. Vendors update their signature databases and anti-phishing filters around the clock, and the major suites now add web protection that blocks fraudulent pages, a firewall and often a password manager. Here are the ones we recommend to protect the workstation of a site administrator or a small business, with prices checked on October 23, 2026.

For a freelancer with one computer and a phone, a three-device plan is more than enough. A small team will be better off looking at five- or ten-device plans, where the price per device drops quickly.

Our toolbox for securing your site and your data

Beyond antivirus, a few simple pieces of kit make a real difference when a flaw like PHP2Shell lands on a Tuesday evening: a security key to lock down your hosting accounts, an offline backup drive that nobody can encrypt remotely, and something to keep your hardware running.

Frequently asked questions about the PHP2Shell flaw

What exactly is PHP2Shell?

It is the nickname for two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10. They let an unauthenticated attacker run code on a web server using an unpatched version of PHP.

Is my WordPress site affected?

Very likely, since WordPress runs on PHP. What matters is the PHP version installed on the server and whether your host has applied the patch. You can find the version under Tools, then Site Health, Info tab, Server section.

Which PHP version is safe?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer. On Ubuntu and Debian, an older number can still be patched: you need to look at the package version. PHP 8.3.35, released in September, is not protected.

Should I update WordPress, PrestaShop or my plugins?

That is not enough. The flaw sits in PHP itself. Only updating PHP on the server fixes it.

Why were the French tax and préfecture websites down?

At ANSSI’s request, the Interior Ministry and other government bodies put their exposed sites into preventive maintenance while they installed the fixes. There was no confirmed hack.

Is it dangerous to shop online right now?

Not in itself. The flaw affects servers, not your computer or phone. Just stay alert to unusual emails and text messages, and follow a site’s instructions if it reports an incident.

Will my PHP 7.4 or 8.1 install get patched?

Not by the PHP project through an official release. Some distributions, the sury.org repository, cPanel and extended support vendors offer backported fixes. The real way out is still migrating to PHP 8.2 at the very least, ideally 8.4 or 8.5, bearing in mind that PHP 8.2 will no longer be maintained after December 31, 2026.

An alert that will leave its mark

PHP2Shell will probably go down as one of the defining security episodes of 2026. Not only because of its severity, but because it was a reminder that a government office, a city hall, a Japanese forum and a small online store often rest on the same piece of software, maintained by a small team. The patch has been available since October 21. The real danger now is the servers nobody thinks to update.

Did your host warn you, or did you find out about the problem from the news? Tell us about it in the comments, and check out our practical guide to updating PHP and securing your site.

Main sources: php.net security bulletin (October 20 and 21, 2026), advisories from CISA, the Canadian Centre for Cyber Security, Google Cloud, watchTowr, the PHP Foundation, WordPress.org and Cloudflare, and reporting by Clubic, Melles750, Renseignement Économique, macitynet.it, tuttotech.net and Gigazine. Article updated on October 23, 2026.

As an Amazon Associate, Wanda-techs earns from qualifying purchases. This does not affect our independent analysis or the price you pay.