Millions of exploit attempts, government sites pulled offline, and an AI-found flaw that stayed hidden for years. Here is what happened, who was hit, and how to protect your site.
The PHP2Shell vulnerability turned an ordinary Wednesday into a global emergency. On October 21, 2026, government agencies, hospitals, banks and broadcasters across Europe, Asia and North America pulled websites offline within hours. The reason: two critical flaws in PHP, the language behind nearly 70% of websites, could let an attacker run commands on a server without logging in. Cloudflare then reported millions of exploit attempts. This guide explains what PHP2Shell is, why it happened, which countries and websites were affected, and how serious it really is as of October 26, 2026.
What Is the PHP2Shell Vulnerability?
PHP2Shell is the nickname for two critical PHP security flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Each scored 9.2 out of 10 for severity. Together they can enable PHP remote code execution, meaning an attacker may run their own commands on a vulnerable web server.
The UK’s National Cyber Security Centre explains the mechanics. In CVE-2026-109618, running out of memory can interrupt PHP while request data is only partly set up, and cleanup then trusts that broken data. In CVE-2026-109619, request-related state survives after the memory behind it has been freed. Under certain conditions, that memory corruption can be turned into unauthenticated code execution.
PHP2Shell at a glance
| Detail | Fact |
|---|---|
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Severity | 9.2 / 10 (both) |
| Disclosed | October 21, 2026 |
| Fixed in | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Found by | Calif, OpenAI and Wiz, with AI assistance |
| Nickname in media | “Black October” |
The scale is what alarmed experts. PHP runs WordPress, Drupal, Joomla and Magento, plus shared hosting platforms and vendor software that never advertises it. Researchers say every PHP version since PHP 5 is affected, and the PHP project states there is no complete workaround. Updating PHP itself is the only safe fix. Updating a plugin or theme will not apply it.
Why the PHP2Shell Bug Happened
A Warning Sign From 2024 Went Unfixed
According to Kaspersky, PHP developers noticed signs of a memory-management problem in 2024 after an independent audit. They could not prove it was exploitable for code execution. The fix was postponed because changing it risked breaking compatibility, and the small team lacked resources for such a complex repair. The PHP Foundation has since published its own account and a plan to strengthen PHP security.
How AI Turned a Suspicion Into an Emergency
On August 11, 2026, a researcher at security firm Calif used an OpenAI model to confirm that the flaw could allow unauthenticated remote code execution. OpenAI independently reported the same issue that day. Wiz later reproduced the findings with several AI tools and called the episode an “AI inflection point.” AI systems can now scan huge codebases in hours, which also means attackers can study new patches faster than ever.
The Leak That Broke the Embargo
The public disclosure was originally planned for October 22. On October 20, a since-removed post on Hacker News revealed that two PHP code-execution flaws were coming, and Huntress and watchTowr confirmed the leak was real. PHP moved its release forward and shipped fixes on October 21, about 25 minutes ahead of its own revised schedule. By then, attackers were already probing.
PHP2Shell Attack Timeline: Millions of Hacking Attempts
The numbers show how quickly attackers move once a flaw is public:
- October 17: Amazon’s threat team logged the first known exploit attempt against its honeypot, days before disclosure.
- October 21, before the patch: Cloudflare saw thousands of attempts in the ten hours before the announcement.
- 45 minutes after disclosure: attempts climbed to tens of thousands.
- Two hours after disclosure: hundreds of thousands.
- October 22: millions of attempts, according to Cloudflare CEO Matthew Prince.
One distinction matters: an attempt is not a breach. Millions of requests hit Cloudflare’s network, but many were automated probes that failed against patched or non-vulnerable targets.
Which Countries Were Hit Hardest by PHP2Shell?
No agency has published a reliable country-by-country ranking of attack attempts, so any list claiming one should be treated with caution. Two measurable views exist: where organizations shut sites down, and where vulnerable servers are concentrated.
Countries That Took Websites Offline
According to a Reuters factbox, the response reached the Netherlands, Germany, France, Belgium, Finland, the Czech Republic, Japan, the United Kingdom and Canada. Austria also saw outages. Reporting identified the Netherlands as the country that switched off the most.
Countries With the Most Exposed Servers
Using Shodan data, CybelAngel found about 2.24 million internet-facing PHP hosts, and 59% of those reporting a version run a branch with no official fix. The United States has the most such hosts (228,770), followed by China, Japan and Germany. By share, Algeria (100%), South Korea (82%) and China (75%) are worst. France has 25,439 such hosts, or 54% of its versioned total. A separate census counts far more PHP services in France, but mostly home-router software that is not necessarily exploitable.
Which Websites Were Taken Offline Because of PHP2Shell?
The shutdowns were precautionary, and most organizations reported no compromise. Reuters and other outlets named these affected services:
- Netherlands: Port of Rotterdam, the Overheid.nl government portal, the KNVB football association, the five largest political parties and many hospitals.
- Germany: several federal sites run by the IT provider ITZBund.
- France: prefecture websites and some Orange services.
- Finland: the government’s public web services, shut by state IT centre Valtori.
- Czech Republic and Belgium: the Czech government site and Belgium’s foreign ministry sites.
- Japan: the Ministry of Finance, the Meteorological Agency, the National Tax Agency, plus Nomura, MUFG, ANA and East Japan Railway.
- United Kingdom: BBC web portals and city services such as Edinburgh’s.
- Global platforms: Wikimedia (Wikipedia) and the Internet Archive, which has since returned.
- Canada: some government sites, with no sign of compromise.
How Serious Is the PHP2Shell Breach?
Here is the balanced verdict: the PHP2Shell vulnerability is extremely serious, but a confirmed mass breach has not been publicly documented.
Why it is severe:
- It needs no password and affects default-enabled features such as session upload progress and multipart parsing.
- Working exploit code is circulating, and Wiz called it among the most severe flaws in PHP’s history.
- The US National Security Agency told operators who could not patch immediately to take systems offline.
Why the damage looks limited so far:
- Researchers at watchTowr say most circulating exploits do not achieve code execution, and no break-in was publicly confirmed by October 23.
- Arctic Wolf found no evidence of shell access on any screened site as of October 22.
- Palo Alto Networks Unit 42 withdrew its claim that a European government intrusion used PHP2Shell, saying it could not confirm the link.
What is still worrying: attackers have tried to deploy a Mirai-style botnet, one operator reportedly targeted 123 servers, and CYFIRMA suspects a North Korea-linked campaign is scanning for vulnerable PHP servers. As Axios reported, many organizations mitigated the risk in time. Patching closes the door, but it cannot show whether someone already walked through it.
How to Protect Your Site From PHP2Shell Today
- Inventory every PHP asset. Include hosting providers, agencies and appliances.
- Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM or your web server. Check the version your site reports while serving requests.
- Ask your host to confirm the update, and take a fresh backup first.
- Upgrade end-of-life versions (8.1 and older), or ask your Linux vendor for a backported fix.
- Add a web application firewall. Cloudflare extended protections to all plans, including free.
- Hunt for compromise. Look for web shells, modified PHP files, new admin users and strange outbound connections, going back to June 2026.
Not sure where to begin? The UK’s NCSC guidance lists the priority actions.
Final Verdict: The PHP2Shell Lesson
PHP2Shell shows how a single PHP security flaw can become a worldwide shutdown. A problem suspected in 2024 turned into an emergency once AI proved it was exploitable and a leak shortened the countdown. So far the defenders are winning, but the window between disclosure and attack keeps shrinking. If you run anything on PHP, patch it today.
This article reflects reporting available as of October 26, 2026. Details may change as investigations continue.
