PHP2Shell: Leaked Flaws in the Code Behind 69% of Websites Knock Sites Offline Worldwide

The programming language behind most of the internet had a very bad day.

Two critical security flaws in PHP, the software that runs about 69% of all websites according to W3Techs, leaked online a day before they were due to be disclosed. The PHP project rushed out emergency fixes on Wednesday 21 October. By then, governments in Europe, the UK and the US had already told organisations to think about pulling their websites offline, and many did.

The bugs have been nicknamed PHP2Shell, because they can hand an attacker a "shell": the ability to run their own commands on someone else's server.

What is broken

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, sit in PHP itself rather than in any website's own code. That means a site can be built perfectly and still be exposed.

PHP rates both as critical, scoring them 9.2 out of 10 on the CVSS v4.0 scale. Leaked claims had put them at a perfect 10.

• CVE-2026-109618 comes from the way PHP handles running out of memory while it is still setting up an incoming request. The request data is left half-built, and the clean-up code treats it as valid, which can lead to remote code execution.
• CVE-2026-109619 involves PHP keeping hold of a request's data after the memory behind it has been freed. A later request on the same worker can reach that stale data, letting an attacker read memory or run code.

The second flaw means an attacker may be able to read the memory of a busy server and pull out passwords, tokens, API keys and certificates belonging to other visitors, without breaking in first.

Who is at risk

According to PHP's advisory, every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The vulnerable code has been in PHP for more than a decade, and nearly every version back to PHP 5.4 is affected.

The danger is highest for sites using Apache's mod_php. There, researchers showed that one request from an attacker with no account can trigger the attack before any of the website's own code even runs.

That puts a huge range of software in the firing line, including WordPress, Drupal, Joomla, Magento and Laravel sites, along with control panels such as cPanel and Plesk and the PHP copies bundled inside other products.

A leak forced PHP's hand

The fixes were meant to come out on Thursday 22 October under a coordinated embargo. On Tuesday morning, a post on the Hacker News forum listed both CVE numbers and the planned disclosure date. It was deleted, but screenshots spread.

The security firm watchTowr confirmed the leak, and PHP posted an advance warning that evening. It released the patched versions on Wednesday at around 14:00 UTC, a day ahead of schedule.

AI found it, and AI helped weaponise it

The flaws were found by researchers at Wiz, Calif and OpenAI, whose Codex Security team took part. They worked with PHP's security team and Google's Gemini team on the fix.

OpenAI called PHP2Shell "one of the most impactful security issues in recent memory" and warned that the same AI capabilities could help attackers build exploits quickly. According to The Hacker News, AI models helped turn the bugs into working exploits, letting one researcher do in about a week what would otherwise have taken a team months.

The internet goes dark, on purpose

The reaction was dramatic. CERT-EU said organisations "should consider isolating internet-facing applications from public networks until a fix is available". The UK's National Cyber Security Centre and the US National Security Agency also suggested taking systems offline if they could not be fixed at once, NBC News reported.

Many listened:

• Wikipedia: parts of the site went down on Wednesday morning.
• 4chan, Something Awful and Pinboard went offline to wait for a patch.
• The Netherlands: the MijnOverheid and DigiD government portals, the lower house of parliament's website, the national cyber security centre and several education systems went offline, according to broadcaster NOS.
• BambooHR took its HR service offline in the US, Canada and Ireland and warned payroll would be interrupted.
• Japan: sites including daycare and video game systems went offline voluntarily, according to ITmedia.

Is anyone being hacked yet?

The picture is mixed. Cloudflare's chief technology officer, Dane Knecht, said: "We are seeing early attacks emerging and are updating mitigations as new vectors show up." The WordPress security firm Patchstack also cited reports of active exploitation.

But the US Cybersecurity and Infrastructure Security Agency said it had not seen exploitation when it issued its advisory on Wednesday, and watchTowr and Huntress said the same. No source has yet confirmed a successful break-in.

What to do now

PHP is blunt: updating is the only real fix. "The only mitigation is patching/upgrading PHP," core developer Gina Peter Banyard wrote.

• Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions received patches in advance, so check your package for the CVE numbers rather than the version string.
• Updating WordPress or Laravel is not enough. PHP itself comes from your server, hosting company or container image.
• Old versions: PHP 8.1 and earlier no longer get official updates. PHP has published source patches for 7.4, 8.0 and 8.1 for those who build their own.
• Stopgaps: turning off session upload progress (session.upload_progress.enabled = 0) blocks known paths for the second flaw only, and Cloudflare has pushed firewall rules to all customers, including free plans. Neither replaces the update.
• Look for signs of attack: odd file uploads followed by memory errors or repeated 500 errors, unusually large session cookies, and PHP workers restarting without explanation.

What to watch

• Whether CISA adds the flaws to its list of known exploited vulnerabilities, which would confirm attacks in the wild.
• How fast hosting companies patch shared servers, where millions of small sites live.
• When the sites that went dark come back, and whether any report a breach.

Cover photo: code on a monitor by Markus Spiske / Wikimedia Commons (CC0). Servers by BalticServers.com / Wikimedia Commons (CC BY-SA 3.0); elePHPant by Atomic Taco / Wikimedia Commons (CC BY-SA 2.0). Reporting draws on The Hacker News, BleepingComputer, NBC News and Huntress.