PHP2Shell Security Vulnerabilities and Global Cybersecurity Alert (2026)

PHP2Shell is the collective name for two critical security vulnerabilities detected in the PHP programming environment, widely used in the development of websites and web applications, and registered under the identifiers CVE-2026-109618 and CVE-2026-109619. These vulnerabilities allow an unauthenticated attacker to execute code on a web server.^【1】 Security patches for these vulnerabilities, identified with the aid of artificial intelligence models, were released on 21 October 2026. During this period, cybersecurity agencies in many countries warned organizations that failed to apply the patches promptly to consider taking affected sites offline; numerous government, school, and hospital websites in Europe were temporarily closed as a precaution.^【2】

PHP is a server-side scripting language designed for web development, with its name standing for “PHP: Hypertext Preprocessor”. It runs on web servers to generate dynamic page content, interact with databases, and execute backend application logic before delivering the final HTML output to the user’s browser. PHP is also used in various other products.^【3】 The language runs on most major operating systems, can be executed directly on web servers, and can be embedded into HTML to create dynamic web pages.^【4】

The language’s origins trace back to the early 1990s, when its name was an abbreviation of “Personal Home Page”. PHP forms the foundation of websites based on WordPress, Drupal, Joomla, and Magento. The software is free and open source, maintained by volunteers.^【5】 Its development and maintenance are overseen by the PHP Foundation.^【6】 Since the 2000s, PHP has been used internationally to build websites and underpins numerous platforms such as online stores, Wikipedia and WordPress.^【7】

The vulnerabilities known as PHP2Shell reside directly in the PHP runtime environment, not within any specific application. Therefore, even a website with secure custom code can be affected by these flaws. Both vulnerabilities have been rated 9.2 on the CVSS v4.0 scale.^【8】 The U.S. National Security Agency (NSA) stated that the flaws are in PHP itself, not in the hosted application or its configuration, and that servers running vulnerable PHP versions are exploitable.^【9】

The UK National Cyber Security Centre (NCSC) explained that the issue allows an attacker to trigger an out-of-memory (OOM) condition in PHP, leading to memory corruption, which under certain conditions can be exploited for unauthenticated remote code execution.^【10】

Both vulnerabilities rely on unauthorized access to certain memory regions and the subsequent use of that access to execute malicious code. This means an attacker can remotely execute commands on a server over the internet without needing a password or legitimate account access.^【11】

Memory corruption due to out-of-memory (OOM) occurs when an incomplete process termination caused by memory exhaustion leaves PHP’s request data in an incomplete and corrupted state. Subsequent cleanup operations processing this data can enable attackers to execute remote code.^【12】

Stale global state refers to internal data associated with a request remaining in memory even after that memory has been freed. A subsequent request handled by the same worker process may use this data before the system resets it.^【10】 This results in a use-after-free flaw. Researchers have demonstrated that this flaw can be exploited for remote code execution.^【13】

An attacker can read the memory of a PHP worker process even before gaining code execution privileges. This memory may contain passwords, authentication tokens, API keys, and certificates from other requests. Researchers demonstrated that applications failing to control access to live worker memory are vulnerable; this method operates independently of any application running on PHP.^【8】

All PHP installations serving web requests are affected. These include PHP-FPM, mod_php with Apache, php-cgi, FrankenPHP, and LiteSpeed. The risk is particularly high in configurations using mod_php. The exploitation method demonstrated by researchers requires only a single unauthenticated request to initiate the attack, which occurs before the application’s own code begins execution.^【14】

The vulnerabilities originate not from website code but from PHP itself. Therefore, even a simple web page displaying only “Hello World” running on a vulnerable PHP version can be compromised.^【8】

The NCSC reported that all organizations using any version of PHP are affected.^【10】 The European Union Computer Emergency Response Team (CERT-EU) stated that the vulnerabilities may affect all PHP versions since PHP 5, first released in 2004.^【15】

The cybersecurity firm watchTowr also confirmed that the vulnerabilities affect all PHP versions since PHP 5.^【16】 Tiffany Farriss, Interim Executive Chair of the Drupal Association, stated, “All servers running any PHP version released in the last 20 years are vulnerable. This issue affects the majority of the internet.”^【17】

The vulnerabilities were discovered and reported by teams from Wiz Research, Calif, and OpenAI’s Codex Security team. During the remediation process, the PHP security team collaborated with Google’s Gemini team. The code has existed in PHP for over a decade.^【8】 Calif stated in a blog post that it discovered the vulnerabilities on 1 August 2026 with the aid of a large language model and began working on a fix from that date.^【17】 Calif researchers working with OpenAI reported the first vulnerability on 11 August, while Wiz, an Alphabet-owned security company, reported the second on 24 August.^【18】

Wiz disclosed that it discovered the vulnerabilities using its autonomous AI vulnerability research tool Wiz Atlas, with assistance from Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol models. Calif and Wiz stated they coordinated with each other, the PHP team, and OpenAI during the discovery process.

Calif and the PHP Foundation are participants in the Patch the Planet program initiated by OpenAI. Under this program, participants were granted access to OpenAI’s advanced AI tools to discover and fix vulnerabilities in web development languages. OpenAI stated that one of its own researchers independently discovered the issue around the same time as other companies. The vulnerabilities, undetected for over a decade, were identified in August after only a few weeks of using advanced AI tools. ^【19】

OpenAI reported that it led a coalition of researchers, security providers, and other stakeholders over two months to address the vulnerabilities in PHP. The company stated, “The PHP maintenance team led the patching and release process; our teams and partners such as Wiz and Cloudflare provided research, technical support, and coordination to prepare protections before the disclosure.” OpenAI characterized the vulnerabilities as “one of the most impactful security issues in recent memory” and noted that AI appeared to have discovered them before any attacker could.

The company also stated, “Although significant, these flaws are among several critical vulnerabilities we have already found and are working to fix, and we expect similar findings to sharply increase in the coming months.”^【20】

OpenAI noted that the incident demonstrates how AI can uncover security vulnerabilities but also warned that it may simultaneously help attackers “rapidly develop attack tools and exploits.” The company announced a program to help users check whether their PHP platform is secure.^【21】

Wiz researchers stated, “These findings rank among the most severe security vulnerabilities ever discovered in PHP and likely in software history. The underlying flaws had existed for decades, but demonstrating their exploitability required an extremely complex chain of steps at the very limit of what human researchers could practically achieve. Leading AI models significantly lowered this barrier, transforming a long-standing flaw into a working exploit.”

The researchers noted that AI models helped convert these long-standing flaws into working exploits, enabling a single researcher to accomplish in about a week what would normally take a team months. Calif, tracing the origin of the flaw back to PHP research from 2004, emphasized that understanding the historical context remains important, as current models cannot reliably navigate vague, twenty-year-old foundational code on their own.^【8】

The PHP Foundation planned to jointly disclose the discovery and full remediation to the public in late October 2026. However, details of the vulnerability were leaked on social media on 20 October 2026, Tuesday, prompting the foundation to accelerate its public announcement.^【19】 On 20 October, a post on the Hacker News platform claimed that two PHP remote code execution vulnerabilities, identified by their CVE numbers, would be disclosed on 22 October. PHP issued a preliminary notice that evening and moved the disclosure date to 21 October. The CVSS score of 10.0 mentioned in the leak does not belong to PHP; PHP rated both vulnerabilities at 9.2.^【8】

The PHP Foundation stated that the coordinated disclosure process had been disrupted before the update was released. According to the foundation, Calif accidentally published a video on 20 October at 20:00 UTC demonstrating how the vulnerability could be exploited. On 21 October at 07:41 UTC, Chainguard released compiled software images containing the security patch. As a result, others were able to examine the patch before it was officially announced. According to the White House, the U.S. government was notified of the vulnerability on 16 October 2026.^【17】

Amazon Web Services (AWS) Director of Information Security CJ Moses disclosed that the company’s MadPot honeypot network recorded a PHP2Shell exploitation attempt on 17 October 2026, four days before the public disclosure.^【22】 The attempt originated from an IP address connected to a commercial anonymization network. Moses stated, “The targeting of a honeypot’s anonymized IP address while the vulnerability was under embargo indicates the activity was conducted by a threat actor; however, it remains unclear how the actor acquired exploit knowledge prior to disclosure.”^【23】

AWS researchers reported that honeypots across multiple providers were subjected to numerous exploitation attempts in the hours before the disclosure, targeting diverse attack vectors. Moses stated, “Technical analysis is ongoing, and it remains uncertain whether any of these attempts succeeded against real-world systems,” and added, “PHP2Shell is currently being actively exploited in the wild.”^【24】

Cloudflare Chief Technology Officer Dane Knecht stated that exploitation attempts began before the patch was released and that security measures were updated as attack methods evolved.^【8】

Cloudflare detected that attackers modified malicious code on 21 October at 03:02 UTC to bypass its default firewall rules. The company deployed rules to block known attack methods to protect PHP sites served through Cloudflare. These protections were made available to all customers, including free users.

watchTowr, which reproduced CVE-2026-109618, reported that as of 21 October at 11:26 UTC, it had not detected attacks on live systems. At that time, neither vulnerability appeared on the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) list of known exploited vulnerabilities. However, in an update at 14:19 UTC on the same day, watchTowr reported active exploitation attempts targeting both vulnerabilities. Nevertheless, no successful compromise of a specific server has been confirmed.

Threat intelligence firm Sansec predicted widespread attacks within 15 minutes of the patch release. Patchstack reported receiving reports from hosting partners that the vulnerabilities were being exploited.

FBI Cyber Division warned that the vulnerabilities could enable malicious actors to execute remote code via PHP, potentially compromising sensitive data and networks, and advised operators unable to update immediately to take their sites offline.^【17】

NSA stated on its social media account, “All organizations using PHP on their systems should be prepared to apply an update addressing these two critical vulnerabilities immediately.” ^【18】

In a press bulletin dated 21 October 2026, the NSA prioritized detecting malicious cyber actors attempting to exploit the vulnerabilities known as “PHP2Shell.” The bulletin stated, “‘PHP2Shell’ could allow attackers to gain control of affected web servers without prior access or authentication. Such an access vector could enable attackers to steal sensitive data, disrupt services, or move deeper into a network,” and added, “It is likely that cyber actors will weaponize the PHP2Shell vulnerabilities. These risks are severe enough to require immediate patching across U.S. government departments and agencies.”^【9】

The NSA requested heightened awareness of internet-exposed devices and services dependent on PHP, prioritization of vendor patches related to PHP2Shell, and immediate inventorying of hardware and software services reliant on vulnerable PHP versions. The agency also recommended enhanced logging in network and operational environments, replacement of unsupported PHP services incompatible with the patch, and, when immediate patching is not possible, taking systems offline until fully secured. The NSA noted that the vulnerabilities often provide direct access to a server’s file system or database.

CISA stated in its security advisory that organizations must “immediately update” their PHP installations and added, “Although CISA has not observed exploitation of these vulnerabilities as of the publication date, leaving them unpatched poses a risk to organizations.”^【19】 The White House stated that federal agencies are working with leading AI laboratories to accelerate remediation.

NCSC urged organizations in the UK to act immediately to mitigate the impact of the vulnerabilities. The agency recommended identifying internet-exposed PHP systems first, avoiding the assumption that only older PHP versions are affected, updating to the latest PHP version, and applying additional hardening steps provided by the PHP team. NCSC advised evaluating system takedown if updates cannot be applied and temporary mitigations are not feasible, and recommended searching for backdoors installed by attackers if systems cannot be patched or taken offline. The agency also requested continuous monitoring of security updates from third-party vendors whose products include PHP as a component.^【25】

In the UK, Edinburgh City Council and the BBC temporarily closed some websites and pages; numerous public institutions, including local councils and health boards in Scotland, took their websites offline. ^【21】

CERT-EU stated that the risk scores assigned to the vulnerabilities indicate attackers can execute remote code without authentication. CERT-EU and the UK National Cyber Security Centre (NCSC) recommended that organizations unable to update immediately either block external access to internet-exposed applications or take them completely offline until the vulnerabilities are patched. Following this advice, the University of Geneva’s website was also taken offline on 21 October. ^【26】

In the Netherlands, websites used by citizens to access government services such as DigiD and MijnOverheid were temporarily taken offline. Dutch citizens use the DigiD digital identity system to access many public services such as taxes, health insurance, and social security. MijnOverheid is a government portal where individuals can view official correspondence and personal information from public authorities.^【27】

Prime Minister Rob Jetten stated on his social media account that the government is closely monitoring the situation. Reiterating the advice of the National Cyber Security Centre, Jetten said, “Install the security patch immediately and keep vulnerable systems offline.” He noted that the affected websites would be restored once security is confirmed.

Minister of Justice and Security David van Weel assessed, “The impact of the PHP vulnerabilities could be significant. Therefore, the NCSC advises relevant parties to temporarily take their websites offline to prevent misuse,” and confirmed that a patch to address the vulnerabilities is available.^【28】

The Dutch NCSC, in a warning labeled “high priority” on its website, stated that all PHP installations processing internet requests are affected and that the vulnerabilities can be exploited over the internet without requiring any username or password. The Dutch NCSC also took its own website offline as a precaution. The agency published an inventory list of software products with PHP dependencies that may be affected by the vulnerabilities.^【10】

Numerous organizations in the Netherlands followed the NCSC’s example and proactively closed their public-facing websites. These include Rotterdam Port Authority, the government portal Overheid.nl, the Royal Dutch Football Association (KNVB), the websites of the country’s five largest political parties, and numerous hospital websites. The National Institute for Public Health and the Environment, affiliated with the Dutch government, closed its website, and the lower house of parliament, the House of Representatives (Tweede Kamer), became inaccessible. Some educational systems were also taken offline.

A spokesperson for Germany’s Federal Ministry of Digital Affairs stated that the federal IT service provider ITZBund took several websites offline due to the discovery of the PHP vulnerabilities. The spokesperson noted that the temporary shutdowns were entirely preventive and no known security incidents had occurred.^【29】

France’s Ministry of the Interior stated that, while awaiting a security patch for its PHP framework, it temporarily took offline the websites of local administrative units known as préfectures. The ministry clarified that this step was a precautionary measure while awaiting the patch from the framework’s publisher. It also stated that all its websites were placed in preventive maintenance mode.^【29】

Following reports of cyberattacks exploiting PHP vulnerabilities, Belgium’s Ministry of Foreign Affairs announced it had temporarily taken its websites offline. Belgium’s national cybersecurity center reported no attacks detected against Belgian sites.^【30】

Finland’s national IT center, Valtori, closed the government’s public web services on 21 October as a “precautionary measure.” Valtori stated it detected no attempts to exploit the vulnerabilities and that the outage was not caused by a data breach.^【30】

Finland’s National Cyber Security Centre warned that some government websites were taken offline as part of priority security measures; disruptions also occurred on other websites such as the Helsinki Book Fair and the Finnish Film Foundation.^【31】

The Czech government took its website offline on 21 October at 19:00 local time (17:00 GMT), following the advice of the country’s cybersecurity oversight body, “to allow for the necessary security patches to be applied.” The government office stated, “This measure aims to ensure the secure operation of the website. During the closure, the site and its content will not be publicly accessible. Services will be restored after the recommended security updates are applied.”^【30】

Denmark’s Cybersecurity and Resilience Authority urged system owners to update as soon as possible and, if updating is not feasible, to temporarily take systems offline.

Norway’s National Security Authority warned that the vulnerabilities could allow unauthorized individuals to gain “control” of all affected systems without requiring a password or login. In Norway, websites of the Norwegian Digitalization Agency and Feide, used for secure login and data sharing in education and research, were taken offline.^【32】

In Denmark, the company Kombit, which provides IT services to municipalities, shut down several services, including the national school communication platform.

Japan’s Ministry of Health, Labour and Welfare temporarily suspended a public information-sharing system containing contact details for long-term care providers as a precaution. Prime Minister Takaiçi Sanae urged website owners on a social media platform to “check whether your live site uses PHP and prepare to apply the new patch.”^【30】

Takaiçi stated, “We urgently request everyone to act tonight,” and added, “If applying the patch quickly is difficult, temporarily suspending internet sites and similar measures can be an effective way to reduce risk.”^【21】 Japan’s national cybersecurity office issued a similar warning.

Australia’s signals intelligence agency, the Australian Signals Directorate (ASD), warned organizations and individuals to prepare for upcoming updates and patches. Similar warnings were issued by relevant agencies in Singapore.

Presidency of Cybersecurity of Türkiye has activated nationwide preventive cybersecurity measures against critical security vulnerabilities in the PHP software infrastructure. The Presidency’s statement indicated that security scans have been initiated across systems in Türkiye, particularly in public institutions, and urgent advisories have been issued to relevant authorities to take immediate action. The statement noted that the security vulnerabilities known as “PHP2Shell” carry high risk and pose serious threats such as unauthorized access, data breaches, and disruption of digital services, especially in internet-exposed systems.^【33】

The Presidency communicated technical and administrative measures required through the Cyber Incident Response Teams (SOME) Communication Platform to all institutions and critical infrastructure operators. All system administrators, especially in public institutions and private sector organizations, were urged to review their internet-exposed IT infrastructure and immediately apply the published security updates. Institutions and organizations were advised to immediately implement the measures detailed in the official security advisory at “https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1372”.^【34】

The Wikimedia Foundation, which operates Wikipedia, stated it is working to address the vulnerabilities in PHP and confirmed that all systems supported by the foundation and operated by volunteers using PHP are affected. The online library Internet Archive also temporarily went offline to address the issue.

Human resources software BambooHR took its service offline in the United States, Canada, and Ireland, stating that payroll operations would be disrupted and no timeline was available for service restoration. Mobile operating system developer GrapheneOS temporarily took its user discussion forum offline, stating that proof-of-concept exploits had already been developed and they “did not wish to risk exposure.” WordPress.com operator Automattic stated that its hosted solutions and Tumblr users were not affected by the vulnerabilities.

The FBI’s statement noted that PHP supports approximately 70 percent of websites worldwide.^【32】 Data from the web technology tracking platform W3Techs shows that PHP is used in approximately 75 percent of websites where a programming language can be detected. Data from the internet intelligence company Censys reveals that approximately 1.5 million of 2.6 million servers are running an unpatched version of PHP.^【17】 One security researcher estimated that more than 1.3 million internet-connected servers are likely affected. Wordfence warned that all WordPress sites, which run on PHP-powered servers, are vulnerable; WordPress stated it provided the infrastructure for over 40 percent of the internet last year.^【35】