Sources linked. Allegations are labelled as allegations. Verify with the original source.
⏱️
🤖 Tech & AI › PHP2Shell: the PHP flaw taking websites offline
PHP2Shell: the PHP flaw taking websites offline
By The Trends Incoming team
Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619), nicknamed PHP2Shell, let attackers take over web servers without logging in. CISA says patch now: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. What happened, who is affected and what to do.
What's trending in PHP2Shell: the PHP flaw taking websites offline
PHP2Shell: sites go dark to patch
Two critical PHP flaws let attackers take over web servers without logging in. CISA says update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now, and parts of Wikipedia and several government sites went offline while patching.
The quick version
If you run a website on PHP, patch it today. Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an attacker take over a web server without logging in. On October 21, CISA urged everyone to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and said PHP 8.1 and older have no fix. Sites from government portals to parts of Wikipedia went offline while teams patched, the BBC reports.
| Flaws | CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) |
|---|---|
| Impact | Unauthenticated remote code execution on PHP installations that serve web requests, per CISA |
| Fixed versions | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| PHP 8.1 and older | No fix. CISA says take them offline |
| Found by | Researchers at Calif and Wiz, using AI, through OpenAI's Patch the Planet program (BBC) |
| Exploitation | CISA had not seen it when it published; Cloudflare's CTO told the BBC early attacks were emerging |
| Alert date | Oct 21, 2026 (CISA) |
What happened
The PHP project shipped fixes on Wednesday afternoon, October 21, after details of the flaws leaked on social media a day earlier and forced an early announcement, according to the BBC. The bugs had gone unnoticed for more than a decade. Wiz called them the "most severe vulnerabilities ever discovered" by AI and estimates that roughly 70% of the internet is affected, a figure the BBC says it could not verify.
What went offline
Finland shut some government web services, the Dutch national cyber security centre took its own site down, and Wikimedia took some systems offline as a precaution, per the BBC. Some other sites, including Edinburgh's council site and some BBC programme pages, also went down, though the BBC says a link to PHP wasn't confirmed for all of them.
What to do
- Find your PHP version. Your host's control panel or
php -von the server will tell you. - Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host to confirm it has done so.
- On 8.1 or older? There is no patch. CISA, the NSA and the UK's NCSC advise taking it offline if you can't upgrade.
- A web application firewall may help as a stopgap, CISA says, but it isn't a fix.
Not running a server? You don't need to do anything, though some sites you use may be slow or down for a day or two.
Keep reading
- Our explainer: why half the web is patching this week
- The Google Cloud outage that took Revolut down
- Everything trending in tech and AI
- Trending stocks: chip stocks and big tech
Follow the conversation
Quick answers
What is PHP2Shell?
The nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on PHP installations serving web requests.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per CISA's October 21, 2026 alert.
Is PHP 8.1 affected?
Yes, and CISA says PHP 8.1 and earlier have no fix, so they should be taken offline.
Is PHP2Shell being exploited?
CISA had not observed exploitation when it published. Cloudflare's CTO told the BBC early attacks were emerging.
Who found the PHP flaws?
Researchers at Calif and Wiz, using AI tools through OpenAI's Patch the Planet program, the BBC reports.