Two critical flaws in PHP, the programming language that still runs a large share of the web, triggered an emergency patch and a wave of precautionary website shutdowns across Europe and beyond in late October. Security teams are calling the pair of bugs “PHP2Shell” because, once chained, they let an attacker take over a vulnerable server without ever logging in.
The PHP security team assigned the flaws CVE-2026-109618 and CVE-2026-109619, and rated both 9.2 out of 10 in severity. The first is described as an out-of-memory corruption bug: if a server runs out of memory while it is still partway through setting up a request, PHP’s cleanup process can mistakenly treat that half-finished data as valid, opening a path to run attacker-supplied code. The second is a use-after-free bug, meaning leftover data from one request can point to memory that has already been freed, and a later request handled by the same worker process can be tricked into using it. Researchers say this second flaw can also be used to pull sensitive information out of server memory, not just run code.
What makes the bugs so dangerous is how little an attacker needs to exploit them. According to Tenable’s security team, almost any PHP setup that handles live web traffic is exposed, including the popular PHP-FPM and mod_php configurations, php-cgi, FrankenPHP and LiteSpeed. Tenable says mod_php carries the highest risk, because a malicious request can trigger the bug before a single line of the website’s own code even runs. Researchers reported working pre-authentication exploit chains against specific versions of WordPress, Drupal, Joomla and Magento, the content management systems that power a large portion of the world’s websites.
A leak before the official fix
PHP’s maintainers had scheduled a coordinated patch release for October 21 at 14:00 UTC and asked site operators to prepare in advance. Technical details leaked online before that window opened, and cloud security firm Amazon says its threat intelligence team had already spotted an exploitation attempt against one of its honeypot systems four days earlier, on October 17. Dutch security researcher Sansec predicted mass exploitation would start within fifteen minutes of the patches going live. After the release, firms including WatchTowr, Huntress and Sansec reported scanning and exploitation attempts, some of which had begun even before the official fix shipped.
Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions between 7.4 and 8.1, which PHP’s project no longer officially supports, received only limited unofficial source backports. Versions from 5.4 through 7.3 are end of life and will not be patched at all. Research cited by Tenable traced the vulnerable code back as far as PHP 5.4.0, which means the flaw had existed, undiscovered, in PHP’s codebase for well over a decade before a researcher working under the name Calif found it in August, reportedly with help from a large language model, and reported it to the PHP security team.
Governments took no chances
The real-world fallout was immediate and visible. The Netherlands’ National Cyber Security Centre took its own website offline as a precaution, and the Port of Rotterdam, the government portal Overheid.nl, the KNVB soccer association, the country’s five largest political parties and several hospitals followed suit, according to Reuters reporting carried by CTV News. Denmark’s municipal IT provider Kombit shut down a number of services, including the national school communication platform, while Finland’s state IT provider Valtori took government network services offline as a precaution. France’s Interior Ministry placed its websites into preventive maintenance, and Japanese Prime Minister Sanae Takaichi urged website operators on social media to check whether they ran PHP and prepare to patch. The Wikimedia Foundation took an unspecified number of systems down until they could be patched, and the Internet Archive briefly went offline as well.
Scale estimates underline why so many organizations moved so quickly. Internet-scanning firm Censys found that about 1.5 million of 2.6 million PHP hosts it tracked were still running a version with no available fix. PHP itself still powers roughly 75 percent of websites whose server-side language can be identified, according to W3Techs. Tiffany Farriss, interim chief executive of the Drupal Association, summed up the stakes bluntly: “This issue impacts the majority of the internet.”
No independently verified, functional proof-of-concept exploit had been confirmed publicly at the time of the PHP Foundation’s disclosure, though that changed quickly once patches shipped. Organizations running PHP in any form, especially older or unsupported versions, are urged to patch to the fixed releases immediately, or to take affected services offline until they can.
Sources: Tenable, “php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ”; SecurityWeek, “PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws”; Reuters via KSL, “Cyber agency warns websites may go dark as PHP prepares critical fix”.
