On 21 October 2026, the PHP security team released emergency patches for two critical remote-code-execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — collectively known as PHP2Shell. Both were rated 9.2 out of 10 on the CVSS v4.0 severity scale. Government websites across Europe went offline. The FBI issued an urgent advisory. An estimated 2.24 million internet-facing hosts were exposed — and 59% of those running identifiable PHP versions had no patch coming.
This is not a routine software update. PHP powers roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs. That means the PHP internet disaster — as it is being called — is not a niche technical problem. It is a threat that sits directly underneath the majority of the web, including WordPress, Drupal, Joomla, Laravel, WooCommerce and thousands of custom-built applications. If your business has a website, this likely affects you.
01
The PHP internet disaster unfolded rapidly across two days. Here is the verified timeline:
| Date / Time (UTC) | Event | Source |
|---|---|---|
| 20 Oct — advance notice | PHP security team announces out-of-cycle emergency release; two critical vulnerabilities, both CVSS v4.0 9.2, disclosed to maintainers in advance | CERT-EU, PHP.net |
| 20 Oct — same day | Security firm watchTowr confirms leaked vulnerability details are real; registers CVE-2026-109618 and CVE-2026-109619 | watchTowr |
| 20 Oct — evening | Dark web exploit forums begin discussing the vulnerabilities; one post reads: “[the] Internet will be on fire.” Automated scanners reportedly begin probing for vulnerable systems before any patch exists | Bitsight Threat Intelligence |
| 21 Oct — morning | Dutch cybersecurity agency (NCSC-NL) takes its own public-facing website offline as a precaution; government websites in the Netherlands and Finland follow; EU, UK, Australian and Japanese cybersecurity agencies issue urgent advisories | Reuters, CERT-EU, NCSC |
| 21 Oct — 14:00 UTC | PHP releases emergency security fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; urges immediate upgrade | PHP.net |
| 21 Oct — afternoon | Cloudflare pushes emergency WAF ruleset update adding four rules targeting the flaws; FBI issues advisory on X warning of remote code execution risk | FBI, Cloudflare |
| 21 Oct onwards | Reports of active exploitation begin; Malwarebytes and others confirm attack attempts in the wild; CERT-EU recommends isolating internet-facing PHP applications unable to be patched immediately | Malwarebytes, CERT-EU |
02
The name PHP internet disaster is not media sensationalism. It reflects a specific technical reality: the vulnerabilities exist in PHP core itself — not a plugin, not a theme, not a third-party library — meaning every application built on any vulnerable version of PHP is potentially exposed. Malwarebytes’ coverage described the attack surface as unusually broad because PHP underlies not just websites but also IoT device management interfaces, internal business applications, legacy systems and thousands of forgotten, unmaintained digital properties still accessible from the public internet.
The risk doesn’t end when the official patch releases. 59% of the 1.5 million hosts that expose their PHP version run a branch that receives no official security update — meaning PHP 7.x, PHP 5.x and other end-of-life versions will remain permanently vulnerable unless the underlying software is upgraded or replaced. Tiffany Farriss, interim CEO of the Drupal Association, described the scale directly: “This issue impacts the majority of the internet.”
03
Both vulnerabilities are critical remote code execution (RCE) flaws in PHP core, rated 9.2 under CVSS v4.0 — one of the highest severity levels possible. Here is what that means in plain language:
CVE-2026-109618
Triggers an out-of-memory condition in the PHP runtime leading to memory corruption. An unauthenticated attacker can exploit this to execute arbitrary code on the server — without needing a username or password.
CVE-2026-109619
Enables memory disclosure — an attacker can read sensitive data from server memory including session tokens, database credentials, encryption keys and user data, without executing code directly.
What RCE Means
Remote Code Execution means an attacker on the other side of the internet can run commands on your server as if they were sitting at the keyboard. They can read, modify or delete data — and install backdoors for future access.
Leaked Before Patch
Crucially, exploit details were leaked on the internet before the official patch existed. Automated scanners were already probing for vulnerable systems hours before PHP released its fix at 14:00 UTC on 21 October.
According to Bitsight’s threat intelligence report, security researchers confirmed a lab reproduction of the exploit before the patch released — meaning organisations should plan for a likely incident response, not a routine patching cycle. The vulnerabilities affect all PHP versions starting from PHP 5, according to watchTowr.
04
Any system running PHP that is accessible from the public internet is potentially at risk. This is broader than most businesses realise:
- WordPress websites — WordPress runs on PHP; any self-hosted WordPress site on an unpatched server is potentially exposed regardless of whether its themes and plugins are updated
- Drupal and Joomla sites — both CMS platforms run on PHP; the Drupal Association explicitly warned its community about this vulnerability
- WooCommerce and PHP-based e-commerce stores — customer data, payment flows and order information are at risk on unpatched servers
- Laravel, Symfony and custom PHP applications — any application built on PHP frameworks is affected at the runtime level
- Shared hosting environments — many Indian businesses use cPanel or shared hosting where the PHP version is controlled by the hosting provider, not the site owner
- Legacy and abandoned websites — forgotten microsites, old landing pages, expired project sites — these are the most dangerous: still running, no one watching, no one patching
- IoT and device management interfaces — many routers, printers and network devices use PHP-based management dashboards, most of which will never receive a patch
05
WordPress powers over 43% of all websites globally. WordPress itself does not need a separate update — the vulnerability lives in the PHP runtime that WordPress runs on. That means the question is not whether your WordPress plugins are updated — it is whether your server is running a patched version of PHP.
Your hosting provider must have applied the PHP update at the server level. Your hosting provider must have applied the PHP update at the server level. If you are on shared hosting, contact your provider directly and ask: “Are you running PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12?” Any lower version number on PHP 8.x is unpatched. PHP 7.x and below will receive no official fix — ever.
For Drupal sites specifically, the risk level may be higher than average because Drupal is commonly used by government agencies, educational institutions and non-profits whose IT teams may lack the resources to patch immediately. The same applies to custom PHP applications built years ago and rarely maintained. Thinkster’s WordPress development and website maintenance services include server-environment checks, PHP version auditing and emergency security response as part of our ongoing support.
06
CERT-EU, the FBI, the UK NCSC, Australia’s ASD and Japan’s NISC have all issued the same core guidance. Here is the consolidated action checklist in priority order:
- Inventory every PHP asset immediately — list every internet-facing website, application, admin panel or device management interface that runs PHP in your organisation
- Check your PHP version now — log in to your hosting control panel (cPanel, Plesk, hosting dashboard) or ask your developer: are you on PHP 8.2.35+, 8.3.36+, 8.4.27+ or 8.5.12+?
- Update PHP immediately — if your hosting provider has released the patched version, update now. On shared hosting, this may require raising a support ticket with your provider
- If you cannot patch, take it offline — CERT-EU explicitly recommends isolating or temporarily taking offline internet-facing PHP applications that cannot be patched immediately. An offline website causes inconvenience; a compromised server causes a breach
- Enable a WAF if you don’t have one — Cloudflare pushed emergency WAF rules targeting PHP2Shell; if you use Cloudflare, ensure your WAF is active. Other WAF providers are following
- Monitor server logs for suspicious activity — look for unusual POST requests, error spikes, unexpected outbound connections or unexplained resource consumption starting from 20 October onwards
- Plan for EOL PHP versions — if you are running PHP 7.x or below, you will not receive a patch. Plan migration to a supported branch (PHP 8.2+) as a priority — this is no longer optional
- Audit abandoned websites — forgotten microsites and legacy applications sitting on your domain or server are now your highest-risk assets. Identify them and either patch, migrate or take them offline
🔥
The most searched angle of the PHP2Shell story — and the one that changes how every business should think about cybersecurity going forward — is how these vulnerabilities were discovered.
According to multiple reports, an AI model (GPT-5.6 Sol) assisted in identifying one of the two PHP vulnerabilities. Cybersecurity firm Wiz independently found and reported both flaws. The flaw had reportedly gone unnoticed for more than a decade — hidden inside PHP’s core runtime, surviving version after version, until AI-powered analysis found it. This is the dual-role AI moment the security industry has been warning about:
| AI’s Role | What It Means in Practice |
|---|---|
| Defender: AI found a 10-year-old flaw | AI-powered code analysis can surface vulnerabilities that years of human review missed — a genuine advantage for defenders who adopt it |
| Attacker: same AI capability can find exploits | The same models that find vulnerabilities for defenders can theoretically be used to scan for exploitable weaknesses at machine speed |
| Scale shift: automated scanning before patch | Automated scanners were probing for vulnerable PHP systems before the patch released — showing how quickly threat actors move from disclosure to exploitation |
| Speed gap: patch vs exploit timeline | The window between vulnerability disclosure and active exploitation is now measured in hours, not weeks — legacy “patch next quarter” schedules are now genuinely dangerous |
TechZine’s analysis put it directly: supply chain connections mean systems appearing offline from the public internet can still be reached through routing errors and vendor integrations — making the isolation advice more complex than it sounds. CybelAngel’s research goes further: because 59% of PHP hosts run branches that will receive no official fix, the long tail of this vulnerability will stretch for years — not days. The businesses most at risk are not the ones that haven’t patched yet. They are the ones that don’t know they’re running PHP at all.
07
Thinkster manages websites, WordPress builds and digital infrastructure for businesses across India. When a security event of this scale occurs, our first responsibility is to our clients. Here is what we are actively doing and offering:
PHP Version Audit
We are checking PHP versions across all client websites and hosting environments, identifying unpatched servers and coordinating updates with hosting providers on clients’ behalf.
WordPress Security Hardening
For WordPress sites specifically, we are reviewing server-level PHP configurations, WAF settings, server logs and access controls — not just plugin updates.
Legacy Asset Discovery
We help businesses identify forgotten PHP-based microsites, old landing pages, staging environments and legacy applications that may be running — and exposed — without anyone realising.
EOL PHP Migration
If your site runs PHP 7.x or below, we can plan and execute a migration to PHP 8.2+ — ensuring your application works correctly on the patched, supported branch.
Not a current client? This is still a good time to get a second opinion on your website’s security posture. Contact Thinkster for a website security audit. Our website services and technical SEO work both include performance and security-oriented infrastructure review.
08
PHP2Shell is a specific event. But the conditions that made it dangerous — abandoned infrastructure, slow patching cycles, unknown PHP assets, end-of-life software — are not unique to this vulnerability. They describe the baseline security posture of a significant proportion of businesses on the internet today.
- Forgotten infrastructure is your highest risk — abandoned websites, old microsites, staging environments and legacy applications accumulate over time and become unpatched attack surfaces
- Patch windows are now measured in hours — the gap between vulnerability disclosure and active exploitation has compressed dramatically; next-quarter patching schedules are now genuinely dangerous
- End-of-life software creates permanent vulnerability — PHP 7.x and below will never receive a PHP2Shell fix; any business running EOL software has accepted a permanent, unfixable risk
- AI changes both sides of the security equation — it found a decade-old flaw, which is excellent; it can also be used to accelerate exploit development and scanning, which is not
- Website maintenance is not optional — a website without ongoing maintenance is not a stable asset; it is a gradually accumulating risk that compounds with every unpatched CVE
PHP2Shell did not create a new class of risk. It revealed the scale of risk that already existed — in forgotten infrastructure, end-of-life software and organisations that don’t know what PHP assets they run. The patch is available. The question is: do you know everywhere you need to apply it?
Frequently Asked Questions
PHP2Shell is the name given to two critical remote code execution vulnerabilities in PHP core — CVE-2026-109618 and CVE-2026-109619 — both rated 9.2 out of 10 under CVSS v4.0. They allow an unauthenticated attacker to remotely execute code on a vulnerable server. Emergency patches were released on 21 October 2026.
Yes. WordPress runs on PHP, and the vulnerability exists in the PHP runtime itself — not in WordPress themes or plugins. If your server runs an unpatched PHP version, your WordPress site is potentially at risk regardless of whether your plugins and themes are up to date. Check that your hosting provider has updated to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
The patched versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 7.x and all earlier versions will receive no official patch — they remain permanently vulnerable. If you are on any PHP 7.x version, migration to PHP 8.2+ is now urgent, not optional.
On shared hosting, the PHP version is controlled by your hosting provider. Contact your provider directly and ask whether they have applied the PHP2Shell security patches. Ask specifically for the PHP version number now running on your account. If they have not patched and cannot give you a timeline, consider temporarily disabling internet-facing applications until they do.
Cybersecurity agencies in the EU, UK, Australia, Japan and the Netherlands recommended that organisations unable to patch immediately should take vulnerable PHP applications offline as a precaution. Several government sites — including the Dutch cybersecurity agency itself — complied with this guidance proactively rather than risk exploitation while unpatched.
Cybersecurity firm Wiz independently found and reported both vulnerabilities. An AI model (GPT-5.6 Sol) reportedly assisted in identifying one of the two flaws. The vulnerability had reportedly existed in PHP core for over a decade before being discovered — highlighting both the power of AI-assisted security analysis and the risk of long-lived hidden flaws in widely used open-source software.
Cloudflare pushed emergency WAF rules to help block known exploit patterns, but explicitly described them as a stopgap — not a replacement for patching. A WAF reduces risk; it does not eliminate the underlying vulnerability. Patching PHP remains the only complete fix.
Automated scanners were probing for vulnerable PHP systems before the patch released on 21 October. If your site was unpatched during this window, patching PHP now stops future exploitation but does not remove any backdoors already installed. You should audit server logs from 20 October onwards, scan for unexpected files, and consider a full security review of your server environment.
Is Your Website
Protected Right Now?
Thinkster audits PHP environments, WordPress security configurations and website infrastructure for businesses across India. If you’re unsure whether your site is protected from PHP2Shell, let’s find out together — before an attacker does.
