We analyzed this claim: is it true that

public exploits and early attacks hit servers running PHP before emergency patches became available?

PHP fixes flaws rated 9.2 as exploit leaks drive early attacksAI generatedConfirmed

PHP published advisories confirming two critical remote code execution flaws, while Cloudflare and Patchstack recorded early attack attempts before patches arrived, though public data does not show how many servers were successfully breached

Tech & AI

PHP fixes flaws rated 9.2 as exploit leaks drive early attacks

Millions of web servers face takeover risks after flaws leaked before fixes arrived.

Published
NRB — News Republic Brigade

Other links

PHP security team

The story continues

Updates

  • 21 October 2026CISA Cyber urged organizations to patch CVE-2026-109618 and CVE-2026-109619 immediately as they enable unauthenticated remote code execution on web servers. ↗
  • 21 October 2026HeroDevs released commercial extended support patches for unsupported legacy installations running end of life PHP versions including PHP 7 and 8.1 ↗
  • 21 October 2026Palo Alto Networks Unit 42 published threat intelligence outlining exploit mechanics and monitoring telemetry for scans probing vulnerable internet facing infrastructure ↗
  • 21 October 2026Wordfence instructed administrators of WordPress websites to immediately upgrade server PHP packages because CMS level updates cannot mitigate flaws. ↗
  • 21 October 2026Japanese Prime Minister Sanae Takaichi urged websites using PHP to prepare for the 14:00 UTC patch or consider temporary shutdowns. ↗
  • 21 October 2026Rapid7 released guidance warning organizations that unauthenticated remote code execution exploit code is circulating and mass exploitation remains imminent. ↗
  • 21 October 2026Critical government websites across Europe went dark as authorities rushed to mitigate an actively exploited security vulnerability in widely used PHP software. ↗
  • 21 October 2026Multiple Japanese platforms including pixiv, NicoNico and Codmon entered emergency maintenance due to the PHP2Shell vulnerabilities. ↗
  • 21 October 2026FBI Cyber Division warned of CVE-2026-109618 and CVE-2026-109619 enabling remote code execution and urged immediate updates or taking systems offline. ↗
  • 21 October 2026BreachForums and Dread have taken their sites offline as a precaution until PHP is patched globally against the critical vulnerabilities. ↗
  • 21 October 2026Numerous gaming platforms, forums and wiki sites including 4chan, Uma Musume and Miraheze have gone offline or entered maintenance mode due to PHP2Shell. ↗
  • 21 October 2026PHP2Shell enables remote reading of live PHP worker memory potentially exposing passwords, session tokens, API keys and certificates from other requests. ↗
  • 21 October 2026OpenAI coordinated the emergency disclosure of two critical zero-day vulnerabilities discovered by AI models affecting global web infrastructure. ↗
  • 21 October 2026Researchers and Cloudflare confirmed exploitation attempts in the wild using a leaked PHP2Shell tool targeting session upload progress paths. ↗
  • 21 October 2026WordPress confirmed the issues are not WordPress-specific and directed site owners to confirm hosting providers update PHP immediately. ↗
  • 21 October 2026BleepingComputer reported that hundreds of thousands of internet facing web servers remain unprotected against critical remote code execution vulnerabilities ↗
  • 21 October 2026Cloudflare offers a one-click mitigation button in the security dashboard to protect PHP sites from PHP2Shell while recommending full PHP patches. ↗
  • 21 October 2026Researchers showed PHP2Shell allows pre-authentication remote code execution on WordPress, Drupal and Joomla sites due to flaws in the PHP core. ↗
  • 21 October 2026PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing unauthenticated remote code execution flaws CVE-2026-109618 and CVE-2026-109619. ↗

In a nutshell

Leaked technical instructions for exploiting two critical memory flaws in PHP forced emergency software updates and defensive network blackouts worldwide. The flaws allow unauthenticated attackers to seize control of web servers before underlying applications load, prompting network providers to deploy emergency filters and Dutch public agencies to shutter online citizen portals. Upstream maintainers released four updated software versions, confirming that full system upgrades represent the only reliable defense against server takeovers.

Highlights

  • PHP released four patched software versions, 8.2.35, 8.3.36, 8.4.27, and 8.5.12, to eliminate remote code execution risks.
  • Both security flaws carry a 9.2 severity rating out of 10 under the Common Vulnerability Scoring System.
  • Dutch authorities took national digital identity service DigiD and portal MijnOverheid offline as a defensive safeguard.
  • Internet scanner VirusTotal cataloged roughly 5.1 million internet addresses associated with PHP infrastructure.
  • Approximately 758,000 scanned web servers ran legacy, unsupported PHP versions between 5.4 and 8.1.

From the Editor’s Diary

When security flaws reside in core web programming languages rather than individual website applications, traffic filters and software settings cannot substitute for installing foundational engine updates.

Who's involved

  • PHP security team

    Maintainers responsible for security fixes in PHP, the open-source engine powering millions of websites

    goal → Verify technical weaknesses, coordinate disclosure timelines, and publish repaired software across supported branches

  • Unidentified attackers and exploit publishers

    Individuals writing and circulating code recipes that trigger flaws to hijack servers

    goal → Gain unauthorized control over internet-connected servers and distribute reusable attack tools

  • Cloudflare

    Web infrastructure provider that filters malicious traffic before requests reach customer servers

    goal → Block detected exploit traffic across client networks, including accounts on free service tiers

  • Patchstack

    Security company protecting web hosting providers and business applications built on PHP

    goal → Track active web attacks and alert server administrators before hostile intrusions succeed

  • watchTowr

    Cybersecurity research firm analyzing software vulnerabilities to test whether attackers can exploit them

    goal → Test leaked software claims and provide technical validation to help administrators spot exposure

  • CERT-EU and national cyber authorities

    European Union and national emergency response agencies issuing threat warnings

    goal → Minimize digital damage by pushing network operators to install patches, isolate systems, and cut web access

  • Website operators, including government agencies and Wordfence

    Organizations managing web servers, including public agencies and a WordPress defense service

    goal → Protect administrative systems and citizen data while navigating temporary service interruptions

In short

Millions of web servers running PHP face immediate risks of remote takeover after computer code designed to exploit two critical security flaws leaked onto the internet before official defenses were ready.

The emergency makes mass patch installations and temporary web server shutdowns likely across corporate and government networks worldwide.

That wave of disruption is near-certain because unauthenticated attackers can seize underlying servers before standard website software even begins to run.

Flagged by: Europe Today Barometer · 22 October 2026

How it unfolded

01

A forum warning breaks the disclosure timetable

2026-10-20 – 2026-10-20

The scheduled timetable for fixing the internet's most common website engine collapsed on an online message board. At 15:20 UTC on October 20, an anonymous post on technology forum Hacker News from an account called petecooper warned that two remote code execution flaws in PHP would emerge publicly on October 22 under a maximum 10.0 severity score. While the poster conceded the claim relied solely on an unverified source and offered no technical proof, cybersecurity researchers circulated the warning across the industry. Cybersecurity research firm watchTowr subsequently verified the threat and recreated the flaw in laboratory conditions, forcing the PHP security team to scrap its planned disclosure calendar and rush forward emergency fixes.

1 source
02

PHP Confirms the Emergency and Moves Up Disclosure

2026-10-20 – 2026-10-20

The online rumor hardened into an industry-wide emergency within four hours. After watchTowr reproduced flaw CVE-2026-109618, PHP maintainer Jakub Zelenka announced that the project would deliver emergency security updates on October 21 at 14:00 UTC, while reserving the right to release earlier if attacks spread. Zelenka rated both flaws at 9.2 on the Common Vulnerability Scoring System, down from the leaked post's claim of 10.0, but withheld the list of vulnerable versions to slow down exploit writers. Security firm Huntress confirmed it saw zero attacks inside its monitored client networks that day, leaving open whether attackers were hitting other targets elsewhere.

4 sources
03

Public Exploit Material and Early Attacks Collide

2026-10-21 – 2026-10-21

The warning window slammed shut overnight as working exploit instructions leaked across public code repositories. Malicious files reached Google-owned analysis service VirusTotal at 02:29 UTC, and software defense firm Patchstack reported that web hosting clients were facing live attacks by morning. Cloudflare Chief Technology Officer Dane Knecht disclosed that the network provider was actively blocking early exploit attempts and pushed defensive rules to all customers, including those on unpaid tiers. While published proofs of concept varied from narrow memory crashes to full server takeover tools, the arrival of functional code transformed an administrative warning into active fighting across global hosting networks.

6 sources
04

Cyber Authorities Warn as Essential Services Go Offline

2026-10-21 – 2026-10-21

Mounting attack reports triggered emergency shutdowns of essential public services across Europe before official software fixes arrived. The European Union's cybersecurity body CERT-EU instructed network managers to isolate internet-facing PHP applications, while Poland's national response team CERT Polska urged operators to turn off critical web portals entirely. In the Netherlands, public broadcaster NOS reported that agencies suspended citizen access to national digital identity service DigiD, citizen portal MijnOverheid, and parliament's web portal as a precaution. WordPress security firm Wordfence temporarily pulled its own web services offline to guard its infrastructure, while VirusTotal warned that approximately 758,000 servers were running obsolete, unsupported PHP software.

6 sources
05

Official Patches Reveal Two Different Memory-Corruption Flaws

2026-10-21 – 2026-10-21

The official software release on October 21 revealed that the security hazard ran deeper than a single web setting. Upstream maintainers issued patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, showing that the danger stemmed from two separate memory corruption bugs rather than one isolated file upload tool. Flaw CVE-2026-109618 mishandles out-of-memory errors and leaves corrupted internal data behind, while CVE-2026-109619 leaves behind old memory references that subsequent web requests can hijack. The maintainers warned that disabling file upload progress monitoring or relying on web filtering shields could not block every attack route, leaving full software upgrades as the only complete remedy.

4 sources

We checked again

No new developments at this moment.

Checked PHP's official security advisory (https://www.php.net/archive/2026.php), both GitHub vulnerability advisories, Cloudflare's incident analysis and the Dutch NCSC's operational updates; all verified developments remain dated October 21, 2026, and no subsequent material event is established.

Where things stand

Server administrators must immediately install PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and restart web server worker processes to secure their systems. Sites running legacy PHP versions 7.4, 8.0, and 8.1 must apply emergency source code fixes or obtain vendor backports, as the underlying language branches remain officially retired. While web application firewalls and configuration adjustments reduce immediate exposure, they do not resolve the memory flaws and leave origin servers exposed if attackers bypass external filters. Updating WordPress plugins or themes provides no defense because the vulnerability resides in the core PHP software beneath the website.

Forensic investigations must still confirm how many servers suffered intrusions, whether attackers achieved persistent footholds, and whether private data was stolen. Attack reports from network operators confirm active exploitation attempts, but these records do not establish the global volume of compromised hosts. Evidence does not yet substantiate initial warnings that every version dating back to PHP 5.0 is universally vulnerable, nor does it confirm demonstrations of attacks against default WordPress installations without specific server configurations.

PHP2Shell: the PHP security crisis

Open the dashboard →

Sources

  • watchTowrresearcher-verification · 2026-10-20
  • Huntressearly-threat-monitoring · 2026-10-20
  • Reutersindependent-mainstream-coverage · 2026-10-21