✍️ Blog › 🤖 Tech & AI › PHP2Shell: the PHP flaw taking websites offline
PHP2Shell explained: why websites went dark to patch this week
By The Trends Incoming team · Published 2026-10-23
If a few of your favorite sites blinked out this week, here's probably why. Two serious bugs turned up in PHP, the language quietly running a huge share of the web, and site owners everywhere scrambled to patch.
What it is
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and researchers nicknamed them PHP2Shell. In plain English, they could let a stranger run their own code on a web server without a password. On October 21, the U.S. cybersecurity agency CISA told everyone to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 right away, and said PHP 8.1 and older have no fix at all.
| Fixed versions | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
|---|---|
| PHP 8.1 or older | No patch; take it offline |
| Found by | Calif and Wiz researchers, using AI |
| Exploited? | Not seen by CISA at publication; Cloudflare's CTO told the BBC early attacks were emerging |
Why it's trending
Three things made this huge. The bugs sat unnoticed for more than a decade. Details leaked on social media before the fix was ready, which forced an early announcement. And the researchers found them with AI, through OpenAI's Patch the Planet program, per the BBC. Wiz called them the "most severe vulnerabilities ever discovered" by AI. Then the outages started: Finnish government services, the Dutch cyber agency's own site and some Wikimedia systems all went offline while teams patched.
Where to follow it
CISA's alert and PHP.net are the official sources. If you run a site, ask your host whether it's patched. On social, #PHP and #infosec are where developers are trading notes. Our PHP2Shell guide has the step-by-step checklist, and you can catch up on the Google Cloud outage that took Revolut down, open-weight AI models and everything else in tech and AI.
Quick answers
What is PHP2Shell?
The nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on PHP installations serving web requests.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per CISA's October 21, 2026 alert.
Is PHP 8.1 affected?
Yes, and CISA says PHP 8.1 and earlier have no fix, so they should be taken offline.
Is PHP2Shell being exploited?
CISA had not observed exploitation when it published. Cloudflare's CTO told the BBC early attacks were emerging.
Follow it
The trend card
PHP2Shell: sites go dark to patch
Two critical PHP flaws let attackers take over web servers without logging in. CISA says update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now, and parts of Wikipedia and several government sites went offline while patching.
Sources
- CISA: critical PHP vulnerabilities require immediate patching (Oct 21)
- BBC News: websites go offline over PHP flaws
- PHP.net: official downloads
By The Trends Incoming team · Fact-checked 2026-10-31. Dates change, so double-check with the official source.