Tech & AISportsCultureHealthMoneyWorldScience
Cybersecurity · special report

PHP2Shell: the PHP security crisis

Two critical PHP flaws — CVE-2026-109618 and CVE-2026-109619 — leaked with working exploits before the fix. What happened, who is affected and how to protect yourself.

Fix released Oct 21Attacks since Oct 17WAF = stopgap
updated
30 stories · 42 reactionsLatest: PHP emergency website patch faces unproven bypass fears ·
See them ↓

The world reacts

Governments, agencies and companies — when they warned.

EUCERT-EUOct 20PHP projectOct 20CACanada's Cyber CentreOct 21CiscoOct 21CloudflareOct 21CZCzech NÚKIBOct 21EUENISAOct 21JPJapan IPAOct 21GBNHS EnglandOct 21USNSAOct 21PatchstackOct 21PLCERT PolskaOct 21AmazonOct 21AUAustralia ASDOct 21BroadcomOct 21USCISAOct 21NLDutch NCSCOct 21EUEuropean CommissionOct 21EUEuropolOct 21USFBIOct 21BGICDSoftOct 21JetHostOct 21NLLogiusOct 21MoodleOct 21PHP FoundationOct 21SebsoftOct 21SGSingapore CSAOct 21GBUK NCSCOct 21VercelOct 21VirusTotalOct 21WordPress.comOct 21Palo Alto Networks Unit 42Oct 22BDBangladesh e-GOV CIRTOct 22B. BraunOct 22F5 LabsOct 22INIndia CERT-InOct 22PHPhilippines CERT-PHOct 22Authentic8Oct 22NZNew Zealand NCSCOct 22 · updated alertCloudLinuxOct 23TenableOct 23MYMalaysia MyCERTOct 24
governments and agenciescompanies

Affected sites

Taken offline as a precaution — and when they came back.

addy.iooffline Oct 21still offlineDigiDoffline Oct 21back Oct 21no breach establishedMijnOverheidoffline Oct 21back Oct 21no breach establishedMirahezeoffline Oct 21still offlineno breach establishedMoodle.orgoffline Oct 21back Oct 22no breach establishedOverheid.nloffline Oct 21still offlineno breach establishedWeird Gloop wikisoffline Oct 21still offline

Timeline

From the leak to today — every event with its source.

  1. CloudLinux alt-php stable distribution
  2. PHP 8.5.12 GitHub release
  3. PHP emergency release schedule
  4. PHP emergency release
  5. Chainguard early patched images
  6. Cloudflare default WAF deployment
  7. PHP 8.5.12 regression issue
  8. CERT-EU PHP2Shell advisory
  9. PHP Foundation emergency announcement
  10. PHP Foundation October forum leak
  11. AWS MadPot PHP2Shell attempt

Versions

Which PHP version was vulnerable, which is fixed and which is still supported.

BranchVulnerableFixed inSupported until
PHP 8.5yes8.5.12Dec 31, 2029
PHP 8.4yes8.4.27Dec 31, 2028
PHP 8.3yes8.3.36Dec 31, 2027
PHP 8.2yes8.2.35Dec 31, 2026
PHP 8.1yesno official fix
unofficial fix code		ended · Dec 31, 2025
PHP 8.0yesno official fix
unofficial fix code		ended · Nov 26, 2023
PHP 7.4yesno official fix
unofficial fix code		ended · Nov 28, 2022
PHP 7.3yesno official fixended
PHP 5.4–7.2yesno official fixended
PHP 5.3 and olderunverifiedno official fixended

Is the web moving to the fix?

How many servers show their version — and which versions they run. · VirusTotal PHP footprint 2026-10-21

show their version1.1M
on supported versions272,000
on ended versions (5.4–8.1)758,000
still on the September releases85,000
0.2% of CloudLinux servers get the new builds gradually

How much of the web is affected

Share of all websites — the systems that run on PHP.

WordPress39.6%
Joomla1.1%
Drupal0.6%
Moodle0.1%

Our stories

Newest first.

Analysis
Few Hands Guard the Web's Backbone

A tiny nonprofit team protects software running most websites, leaving critical fixes delayed by thin budgets.

Analysis
Bug Shutdowns Hit Public Disaster Alerts

Taking services offline to block hackers has begun interrupting critical emergency warnings.

Analysis
Key PHP2Shell Government Breach Claim Retracted

Cybersecurity firm Palo Alto Networks has withdrawn its report linking a European government hack to two flawed PHP flaws.

Analysis
Web Fixes Spread but Attack Proof Fails

Website updates are rising and offline services are reopening, but researchers had to withdraw a major claim of a successful breach.

Analysis
European Advisories Dispute PHP Patch Timestamps

Official European notices give conflicting times for emergency fixes to the software behind millions of websites.

Analysis
Software Alarm Sounds Without Global Orders to Act

Most national agencies issued urgent advice rather than binding legal ultimatums.

Analysis
When Safety Shut Down the Web

Precautionary shutdowns during the PHP security crisis disrupted everyday services before any cyberattack was confirmed.

Analysis
Why the Internet Counts Flaws Differently

Wildly varying counts of exposed servers reflect different yardsticks, not a settled tally of vulnerable sites.

Analysis
Botnet Trail Misses State Hacker Link

Early attacks using the PHP flaws show automated criminal tools, not confirmed government spies.

Analysis
New PHP2Shell Fixes Still Leave Websites Exposed

Fresh updates from device makers plug key gaps, but full protection remains unfinished.

Analysis
Flaws in Web Language Reach Corporate Firewalls

Flaws inside a standard web tool leave corporate network guards waiting on custom repairs.

Analysis
Flaws Crack Defenses, but Breaches Remain Unproven

Lab tests showed ways past standard website defenses, yet no real-world victims have emerged.

Analysis
Amazon Spotted Web Attacks Early, but Victims Remain Unfound

Online traps caught intrusion attempts days before fixes arrived, yet no confirmed breaches have emerged.

Analysis
Why Web Firewalls Cannot Stop PHP2Shell

Digital shields can filter traffic at the door, but only software updates fix the break inside.

Analysis
Emergency PHP Fix Stumbles on New Glitches

Urgent security repairs for the web's backbone broke working code, forcing administrators to balance safety against site stability.

Analysis
European States Pull Own Sites Offline to Prevent Hacks

Governments took public services down after an urgent software warning.

Analysis
Bulgaria Hosts Patch While Public Risk Remains Unknown

Commercial web hosts moved fast to fix critical software flaws, but official systems have not disclosed their exposure.

Analysis
Hackers Target PHP Flaw, but Breaches Remain Unverified

Millions of web servers faced attacks after emergency security alerts, but verified break-ins have not emerged.

Analysis
Why Updating PHP Does Not Prove a Site Is Safe

Applying an emergency security patch does not guarantee that a website is protected or clean.

Analysis
Emergency PHP Patches Spread but Danger Remains Unclear

Millions of web servers have installed fixes, but researchers cannot yet confirm whether successful break-ins are falling.

Analysis
How AI Unlocked Long-Ignored Web Flaws

Artificial intelligence helped researchers turn theoretical bugs into working website attacks, exposing an imbalance between finding flaws and fixing them.

Analysis
New Flaw Leaves Patched Websites Open to Attack

Emergency repairs for the web's most popular code missed a narrow backdoor.

Analysis
A Third Flaw Complicates PHP Web Security

Updating software alone may not protect a website if certain settings remain active.

Analysis
Fixing PHP2Shell Leaves Security Appliances Behind

Web hosts are getting fixes for critical internet flaws while major network hardware waits.

Analysis
How PHP's Secret Fix Fell Apart

A quiet plan to repair flaws in the web's core software unravelled before launch.

Analysis
Fixing PHP2Shell Depends on Who Runs the Server

A flawed web engine exposes millions of sites, but the fix must happen where the code actually runs.

Analysis
Flaw Threatens Millions of Sites, Damage Unproven

A major internet repair effort is underway, but early fears of historic damage remain unverified.

Analysis
Flaws in Web Engine Trigger Worldwide Patch Race

Critical memory bugs in underlying server software exposed millions of websites before fixes were ready.

PHP emergency website patch faces unproven bypass fears

Online warnings claimed that a new fix for the programming language powering millions of websites had failed, but technical evidence shows no broken security update.

PHP fixes flaws rated 9.2 as exploit leaks drive early attacks

Millions of web servers face takeover risks after flaws leaked before fixes arrived.