The short version: Within hours of the October 21 disclosure of two critical PHP flaws known as PHP2Shell, Cloudflare recorded millions of exploitation attempts across its network, with attack volume jumping from thousands to millions in about two hours. Government agencies in the UK, Finland, and Japan took public websites and services offline as a precaution, and the FBI warned operators to patch immediately or disconnect. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS v4.0 score of 9.2, let unauthenticated attackers run code on PHP servers, and PHP powers roughly 70 percent of the world’s websites. The PHP Foundation has also admitted that early signs of the flaw were spotted back in 2024 but went unfixed for two years, calling the delay a structural failure.
Millions of attack attempts within hours
The speed of the response from attackers surprised even seasoned observers. Late on Wednesday, Cloudflare CEO Matthew Prince posted on X that the company’s network had gone from thousands of exploitation attempts in the ten hours before the disclosure to tens of thousands within 45 minutes of it becoming public, then to hundreds of thousands within two hours, and then to millions. Reuters reported his statement on October 22.
To be precise, those figures describe exploitation attempts seen across Cloudflare’s network, not confirmed successful break-ins. Nobody has established how many servers were actually compromised, and several reports stress that the count of compromised systems cannot be derived from attempt volumes alone. Still, the curve shows how quickly automated scanning and exploit tooling move once a critical flaw is public knowledge.
The danger was amplified by how the disclosure played out. According to The Hacker News, the security firm Calif mistakenly posted a video of its working proof of concept around 20:00 UTC on October 20, and at 07:41 UTC on October 21, about six hours before the official fix shipped, the software vendor Chainguard published container images containing the patch. That gave anyone watching a chance to study the fix and build an exploit before most users could update. As Madeline Lawrence, co-founder of Belgian security company Aikido Security, told Reuters, details of the vulnerabilities became public before fixes were ready, creating a difficult race between organizations securing their systems and attackers trying to break in.
Governments and banks took websites offline
Faced with that race, a number of governments and large organizations decided the safest move was to pull the plug temporarily. The Associated Press reported that governments and corporations worked through the night after the disclosure, and by Thursday many sites were back up, although some limited services remained unavailable while security work continued.
In the United Kingdom, the prime minister’s office said some limited government services might be temporarily offline while potential exposures were addressed. The office said work had already taken place across government to identify and fix exposures, and that experts were working closely with OpenAI and international partners. No large public-facing critical services were affected, according to the statement.
Finland’s government websites were partly available on Wednesday. A notice to visitors said government sites were experiencing a temporary disruption and were fully or partially unavailable while the issue was being resolved. By Thursday, Finnish officials said the disruption had been resolved, although some content was still being restored.
Japan reacted at the highest levels. Prime Minister Sanae Takaichi shared a warning on social media urging website administrators to check whether their sites use PHP and to install the patch released late Wednesday, adding that temporarily suspending websites should be considered if applying the fix promptly was difficult. Japan’s Finance Ministry temporarily suspended some website content and services while security measures were put in place, and Japanese lender Mitsubishi UFJ Financial Group said it was temporarily suspending some internet services as an emergency measure.
The FBI’s warning: patch now or disconnect
The FBI’s Cyber Division weighed in on Wednesday with an unusually direct warning. In a post on X, the agency said the vulnerabilities could allow malicious actors to remotely execute code in PHP, the language that powers countless websites and web applications, which raised the risk of sensitive data and networks being compromised. Its advice: update immediately, and if you cannot update, take affected websites offline until you can.
That guidance echoes what European cybersecurity authorities have been telling operators of WordPress and other PHP-based platforms all week: the combination of a remotely exploitable flaw and a language used on the majority of the web leaves little room for waiting. If you run a PHP server and have not yet patched, our breakdown of the PHP2Shell patches explains exactly which versions fix the flaws.
AI found the flaw, and AI may help attackers use it too
One of the most discussed aspects of PHP2Shell is how it was found. Researchers at the security firm Calif, working with OpenAI’s GPT-5.6 Sol model, identified the critical weakness, while Google’s cybersecurity company Wiz independently discovered vulnerabilities using AI-assisted analysis. The Wall Street Journal described the episode as an AI-driven cyber emergency after what it called the Bugmageddon era of AI-assisted bug hunting.
Both flaws sit in core memory-management and error-handling paths that nearly every PHP request touches. In plain terms, one arises when an out-of-memory condition leaves partially initialized data that later cleanup routines treat as valid, enabling memory corruption and remote code execution. The other involves stale global state that survives after a request’s memory is freed, so a later request handled by the same worker process can use a dangling pointer. Researchers demonstrated full remote code execution against Apache running the mod_php module under default settings, and confirmed additional vectors in PHP-FPM under certain configurations.
The discovery also underlines an uncomfortable reality. The same AI capabilities that help defenders uncover dangerous bugs faster can also help attackers build working exploits faster. That asymmetry is exactly why the hours after a disclosure matter so much, and why Cloudflare’s millions-of-attempts chart should worry anyone still running an unpatched server.
The two-year delay the PHP Foundation calls a structural failure
In a candid blog post published after the patches shipped, the PHP Foundation acknowledged that the flaw behind CVE-2026-109618 was first spotted in 2024 and still took two years to fix. In the Foundation’s own words: “We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”
The history, as the Foundation tells it, goes back to PHP’s first external security audit in years. The audit was funded by Germany’s Sovereign Tech Agency, organized by the Open Source Technology Improvement Fund (OSTIF), and carried out by Quarkslab. While fixing one of the issues the audit flagged, a core developer contracted by the Foundation noticed the first signs of the memory problem. At the time, a possible exploit was theorized but no concrete attack path turned up, and bugs with clear, demonstrated impact took priority.
Several proposed fixes each carried real drawbacks. One would have broken compatibility with older software, another opened a possible denial-of-service hole, and a third required changes across thousands of third-party extensions that the team saw no way to coordinate. With a small team working by consensus and few engineers holding deep knowledge of the PHP engine, the work stalled and restarted repeatedly over months. The flaw was flagged again on August 11, 2026, when Calif and OpenAI independently reported the same underlying issue, with Calif demonstrating unconditional remote code execution. Only then did it become a top security priority.
The Foundation says it has changed course since. It established an Ecosystem Security Team in May 2026, hired two additional engineers over the summer, and is replacing consensus-based security decisions with majority voting. It is also appealing for sponsorship from companies, hosting providers, and governments that rely on PHP, noting that its team has published 15 CVEs since July and reviewed more than 100 reports that turned out to be invalid or duplicates. It also criticized how the rollout broke down: Calif’s mistakenly posted demonstration video spread despite being deleted, and Chainguard distributed patched images more than six hours before the scheduled release, letting attackers examine the changes before most users could defend themselves.
What to do right now
If you run anything on PHP, treat this as urgent, not routine maintenance:
- Check your PHP version. Run
php -vor ask your hosting provider. The patched releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Only the supported 8.2 through 8.5 branches received fixes. - Update immediately. If your host manages PHP for you, confirm the update has actually been applied rather than assuming it.
- If you cannot patch now, take the site offline. That is the FBI’s explicit recommendation, and it is what governments and banks chose this week.
- WordPress administrators: your site runs on PHP, so this applies to you directly. Separately, around 600,000 WordPress sites were also exposed by a Backuply SQL injection flaw patched earlier this month, which we covered in our Backuply vulnerability breakdown. Check both.
- After patching, review your server for signs of compromise such as unfamiliar processes, unexpected files, or odd outbound traffic. If the server was reachable while unpatched, consider bringing in incident-response help rather than assuming a clean bill of health.
- Keep watching the wider patch landscape. PHP is not the only server-side runtime fixing critical flaws this month. Node.js shipped fixes for 10 vulnerabilities in its October security update, including a Brotli decoder flaw that permits remote code execution, as detailed in our Node.js October 2026 security update coverage.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the nickname researchers gave to two critical flaws in the PHP programming language, CVE-2026-109618 and CVE-2026-109619. Both allow attackers to execute code on a server running PHP without logging in, and both carry a CVSS v4.0 score of 9.2.
Have attackers actually broken into servers with PHP2Shell?
Exploitation attempts have been confirmed at massive scale, with Cloudflare alone reporting millions of attempts across its network within hours of the disclosure. A confirmed count of successfully compromised servers has not been established by the sources reviewed so far.
Is my WordPress site affected?
WordPress is built on PHP, so if your hosting runs an unpatched PHP version, your site is potentially exposed. Contact your hosting provider to confirm the PHP version and whether the October 21 patches have been applied.
What if my hosting provider has not patched yet?
Push them for a timeline, and seriously consider taking your site offline in the meantime. That is the course of action recommended by the FBI and the European cybersecurity authorities, and it is what multiple governments and banks chose this week.
Which PHP versions receive the fix?
Only supported branches: 8.2, 8.3, 8.4, and 8.5. If you are still on PHP 8.1 or older, those versions no longer receive security updates, and the only safe move is to upgrade to a supported branch.
Why did the fix take two years?
Early signs of the flaw surfaced during PHP’s 2024 external security audit, but no working exploit was known at the time, and proposed fixes each risked breaking compatibility or introducing new problems. A small, consensus-driven security team stalled for months. The PHP Foundation has called that delay a structural failure of its decision process and its resources.
The PHP2Shell episode is a reminder that even the most boring, foundational software can hide critical flaws for years, and that once they surface, the window between disclosure and attack has shrunk to hours. Patch now, and check back for further developments as the investigation into exploitation continues.