PHP2Shell Forced Sites Offline While Exploits Stalled

Nine security firms said Thursday they had not seen a successful PHP2Shell attack, a day after agencies told unpatched sites to go dark. The bugs, CVE-2026-109618 and CVE-2026-109619, sit in PHP itself, the language behind almost 70% of websites, and each scores 9.2 out of 10.

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC on October 21 after a leak forced the project to move patch day up by one day. By Thursday evening, CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos and Trail of Bits still had no confirmed break-in to show.

The Outage Arrived Before the Hack

The first public injury was not a defaced homepage. It was a maintenance page. Finland’s state IT centre, Valtori, pulled government web services as a precaution. The Dutch National Cyber Security Centre took its own site down, and so did DigiD and the House of Representatives. France’s Interior Ministry said prefecture sites, including the Paris police prefecture, went unreachable while a patch was prepared.

In the UK, cybersecurity minister Liz Lloyd told parliament that 32 government services had been taken offline, largely as a precaution while updates were applied. Edinburgh, Bristol and Oxford council sites were among those that went dark. Germany’s federal IT provider ITZBund unplugged several federal pages. The Czech government took its site down at 19:00 local time so patches could be installed. Japan’s prime minister, Sanae Takaichi, told anyone with a public site to check for PHP that night, and services at the finance ministry, the meteorological agency and the national tax agency were partly suspended.

The U.S. National Security Agency told operators that if they could not patch at once they should take the system offline until fully mitigated. The FBI’s cyber division used the same line. The advice is rare for a language bug, and it is why Wikipedia sister projects, hospital portals in the Netherlands, and consumer sites such as pixiv, DMM, niconico and BASE spent Wednesday in emergency maintenance. The outage was the policy working as written.

What PHP2Shell Does

PHP2Shell is not a WordPress plugin hole. It is two flaws in the engine that runs the request, so a fully patched CMS and a ten-line hello-world page are in the same boat if the PHP under them is old. The PHP Foundation says both sit in memory handling and error handling, the parts almost every request touches, which is also why a fix was so hard to ship without breaking extensions.

THE TWO BUGS AND THE FIXES

On Apache with mod_php, the Foundation says an unauthenticated request can trigger the out-of-memory path before application code runs, and full remote code execution was shown with default settings. Remote code execution was also confirmed on PHP-FPM through application-level paths. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are in the advisory too. Updating a theme or a plugin does not close this. The runtime has to move.

Wiz showed unauthenticated code execution against Drupal on August 20 and against WordPress on August 21 in its own tests. Calif, the firm that reported the first clean remote-code path, later showed a private demo spanning Magento, MediaWiki, Joomla, Laravel and others. That is lab work. It is not a victim list.

A Decade-Old Bug, Unlocked by Frontier Models

The ugly part of the story is how long the fault sat in plain sight. Wiz says every PHP release in the last decade is touched by at least one of the two issues, back to 5.4, and that the chain needed to prove it was at the edge of what people could actually pull off. In 2024, during PHP’s first external audit in years, a core developer already saw the out-of-memory problem. A possible exploit was theorized. No concrete remote-code path turned up, other bugs with clearer impact took the queue, and work on a fix stalled because every design choice broke compatibility, invited a new denial of service, or demanded changes across third-party extensions.

Calif began an audit on July 30 under OpenAI’s Patch the Planet program. On August 11, researcher Ryan A at Calif reported an unconditional remote-code path with the same root cause. OpenAI reported the same day. Wiz reported on August 24. OpenAI sent more trigger paths on September 18. From August 11, the Foundation says, fixing it became the top job for everyone it had on security. Wiz’s write-up is blunt about what changed in the meantime: the frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.

That is the defender side of the AI story. The attacker side, at least in the first two days, looked slower. Dan Guido, chief executive of Trail of Bits, said it took one of his people, a 10-year veteran, an entire day to break the bugs with an advanced model. Open-weight models that criminals can strip of guardrails are weaker still, and they struggle with this kind of memory corruption.

A lot of people are confusing proof of concept with exploit. Turns out that writing exploits still requires expertise. You can’t just fake it.

Dan Guido, CEO, Trail of Bits

The Foundation itself has been drowning in AI-written reports. It published 15 CVEs since July 1 and worked through more than 100 filings that were invalid, duplicates, or not reproducible. A person still makes every call and every patch. Tools found this class of bug faster. They did not choose the fix.

Millions of Attempts, Almost No Working Shells

The scan noise was real. Matthew Prince, chief executive of Cloudflare, said the company saw thousands of attempts in the 10 hours before the bugs were announced, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, and millions after that. Attackers mutated payloads to probe Cloudflare’s new rules, which is a tell that they were using blocked responses as feedback. Cloudflare had WAF rules live at 3:02 am UTC on October 21 for free and paid customers, before the 14:00 UTC release, and it had been writing those rules since early October with the Foundation, OpenAI and Wiz.

Amazon’s threat team, looking back through its MadPot honeypots, found an exploit attempt dated October 17, four days before patches existed, from an address tied to a commercial anonymization network. More proof-of-concept traffic hit those sensors between 02:00 and 08:00 UTC on October 21, still before the embargo lifted. CJ Moses, chief information security officer for Amazon Integrated Security, said technical analysis was ongoing and it was unclear whether any of those attempts would have succeeded on real systems.

THE ATTEMPT COUNT, SEPARATED

• Network scans: Prince’s ladder on the Cloudflare edge, from thousands before the announcement to millions after it.
• Published files: Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks’ Unit 42, said her team had more than 200 proof-of-concept samples under review Thursday evening.
• Sophos telemetry: Don Smith, vice president of threat research at Sophos, said that across all of the firm’s sensors, and they were looking hard, they had only seen a couple of real exploitation attempts.
• Confirmed takeovers: the nine firms named above, plus CISA at the time of its alert, reported none.

DeGrippo put the tension in one line: her team had not yet seen the PHP flaws exploited in the wild, and whether active exploits exist is only a matter of time. Smith’s read was that the bugs are harder to use than people first thought, so this could be a slow burn. Sansec, which watches Magento shops, said on October 22 that mass exploitation looked less likely than it had on release day, and that the public exploits do not work against a default PHP install. An attack, in that view, needs specific knowledge of the target and specific conditions on it.

WHAT WE KNOW

• Patches: Official compiled fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, shipped at 14:00 UTC on October 21.
• Scanning: Cloudflare, Amazon, Cisco Talos, watchTowr and others logged exploit-shaped traffic, including before the public release.
• Lab proof: Wiz and Calif demonstrated remote code execution against major CMS stacks in testing.

WHAT IS UNCONFIRMED

• A named victim: No public, attributed break-in had been tied to PHP2Shell by Thursday evening.
• CISA KEV: Neither CVE was in the Known Exploited Vulnerabilities catalog as of October 22.
• Quiet footholds: Prince warned a server could be compromised with no public evidence, which no scan of homepages can rule out.

The panic moved faster than the working shells. Training rooms had students walking the chain on Thursday while national CERTs still had no confirmed break-in to point to. PoC repositories kept appearing on Friday. That is what a hard memory bug looks like in public: a flood of files that claim a shell, and a much smaller set that actually pops one.

Who Pulled the Plug, and for How Long

The shutdown list is a map of who followed the letter of the advice, not a map of who was hit. Automattic said WordPress.com and Tumblr, which it hosts, were not exposed. The risk sits on the long tail: small PHP sites on shared hosts, appliances that bundle their own runtime, and shops whose vendor has not yet shipped a package. Synology confirmed the bugs hit its NAS PHP packages and released updates for DSM 7.4, 7.3 and 7.2. Cisco said it was still checking its catalogue and that some products were affected, with most fixes not yet out.

THE PRECAUTIONARY SHUTDOWNS

• Finland: Valtori took public government web services offline on Wednesday.
• Netherlands: NCSC, DigiD, parliament, Overheid.nl, the Port of Rotterdam, the KNVB, the five largest parties, and multiple hospital sites went dark.
• France and Belgium: Prefecture sites including Paris police, plus other local government pages, at the request of national cyber agencies.
• United Kingdom: 32 government services, per Liz Lloyd, including several council sites.
• Germany and Czechia: ITZBund federal pages, and the Czech government site from 19:00 local time.
• Japan: Partial suspensions at finance, weather and tax agencies, plus Nomura, Mitsubishi UFJ, ANA and East Japan Railway, after Takaichi’s public warning.
• Wikimedia: The foundation said it had taken down a number of other systems as a precaution until they could be safely patched, which knocked some Wikipedia-related services out on Wednesday.

Most of those pages were back once the package landed. The cost was hours of public services, not a proven theft of the databases behind them. Prince said none of Cloudflare’s customers were affected, and that the company had been in talks for months about how to patch the flaw. The quieter operators, the ones who never went dark and never posted a status page, are the ones his warning is aimed at.

The Leak That Moved Patch Day Up

Coordinated disclosure held until two days before the planned date. Then it came apart in public, which is why Wednesday felt like an ambush even though the Foundation had been working the fix since August.

HOW PATCH DAY MOVED

1. July 30, 2026: Calif starts its PHP audit under Patch the Planet.
2. August 11, 2026: Calif and OpenAI report an unconditional remote-code path; the Foundation makes the fix its top security job.
3. August 24, 2026: Wiz reports the bugs. OpenAI sends more trigger paths on September 18.
4. October 17, 2026: Amazon’s MadPot honeypot logs a PHP2Shell-shaped attempt from an anonymized address.
5. October 20, 2026, about 15:00 UTC: The two CVE IDs begin circulating, with a wrong release time and a wrong score of 10.0. No technical details leak. The real score is 9.2.
6. October 20, 19:30 UTC: PHP brings its pre-announcement forward and moves the release from October 22, 14:00 UTC, to October 21, 14:00 UTC, so distributors still have a package path.
7. October 20, about 20:00 UTC: Calif mistakenly publishes a video of its proof of concept. Copies spread after the takedown, and PoC work speeds up.
8. October 21, 07:41 UTC: Chainguard publishes built images that contain the fix, more than six hours before the coordinated release, so anyone can study the binary while other users wait.
9. October 21, 14:00 UTC: PHP ships 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The Foundation says it watched the PoCs that appeared after the leak and did not identify any functional exploits at the time of public disclosure. Mitigation notes it had started sending to a few critical-infrastructure providers around 23:00 UTC on October 20 may have leaked as well. Chainguard’s early images, the Foundation wrote, disregarded weeks of work by many parties. Distributors had the patch early so their users could update the moment the bugs were named. Publishing the built fix early handed that same moment to anyone reading a container registry.

The Foundation called the 2024-to-2026 stall a structural failure: a consensus process that could not pick among ugly trade-offs, and too few engineers who know the engine. It has since stood up an Ecosystem Security Team, hired people to triage and harden, and changed process so leadership can break a deadlock. It is also asking the companies, hosts, and governments that run on PHP to fund that work at a level that matches how much they use it. German Sovereign Tech Agency money paid for the 2024 audit. The Foundation wants that to be normal, not a one-off.

Unsupported PHP Still Has No Official Fix

The four new builds cover the supported 8.2 through 8.5 branches. CISA’s alert is explicit about everyone else. Organizations that cannot update at once, or that still run PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until patched or moved to a supported release. A web application firewall, CISA said, may help in the meantime. It is not a substitute. Elizabeth Barron, executive director of the PHP Foundation, said anyone running unsupported versions is vulnerable and should upgrade as soon as they can.

That is the slow-burn population. Shared hosts, forgotten marketing sites, NAS boxes, and internal tools that have been on 7.4 or 8.0 for years cannot take 8.5.12 without an application rewrite. Some Linux vendors and long-term-support shops received the patch in advance and will backport. Many will not. The NSA list is inventory, patch, log, replace end-of-life PHP, and unplug if you cannot. For a large share of the almost 70% of sites that still speak PHP, unplug is the only honest option until a vendor shows up.

Prince’s other line is the one that survives a quiet Thursday. Something could have gotten compromised very quietly, he said. There may be no public evidence the server was touched, and the intruder could just be hanging out there. Patching does not evict a back door that landed on October 17. The next useful work is log review from that date forward, not another PoC video. The sites that went dark on Wednesday already paid the visible price. The ones that never flickered still have to prove they were only scanned.