PHP Patches Two Critical Remote-Code Flaws as Sites Go Offline and UK Cyber Agency Urges Shutdown of Unpatched Systems

The PHP project released emergency security updates around 10 a.m. ET today, Oct. 21, for two critical flaws in the language that runs most of the web. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an attacker with no account run code on a server. Both are rated 9.2 on the CVSS v4.0 scale.

The flaws sit in the PHP engine itself, not in any website's code. A site with spotless code is still exposed if it runs a vulnerable PHP version. Even a bare "Hello World" page can be attacked, according to the PHP advisory.

What is affected

Every PHP installation serving web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The flaws reach back to PHP 5.4. PHP says mod_php carries the highest risk, because a single unauthenticated request can trigger the attack before any application code runs.

PHP-FPM behaves differently. For one of the two flaws, PHP's own analysis says FPM is susceptible but no complete FPM exploit has been shown. The second flaw has been shown to reach code execution on both mod_php and PHP-FPM, though the FPM path depends on an operation inside the running application.

An attacker can also read memory from the PHP worker process without first gaining code execution. That memory can hold passwords, authentication tokens, API keys and certificates from other requests. Researchers demonstrated this against applications they did not control.

PHP is used by nearly 7 in 10 websites whose server-side language is known, according to W3Techs. WordPress, Drupal, Magento and Joomla all run on it.

The security firm Sansec said researchers at Calif confirmed unauthenticated code execution against Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Nextcloud 35.0.1, Laravel 13.11 and several other applications.

How it unfolded

Details leaked Tuesday afternoon, Oct. 20, ahead of the planned patch. A video posted online that day appeared to show someone using the exploit, though as of late Tuesday there was no evidence of attacks at scale. PHP's security team had warned it reserved the right to release early if details became public.

By Wednesday that had changed. Cloudflare reported early attacks against PHP sites at 07:43 UTC, more than six hours before the fix shipped, according to Sansec. Sansec also said technical writeups and an exploit tool are now public, and it expects mass exploitation. Before the release, Sansec predicted attacks within 15 minutes.

Researchers at Wiz, Calif and OpenAI found and reported the flaws. OpenAI said in a blog post that it helped discover the vulnerability and brought it to PHP before hackers exploited it more severely. The company called it "one of the most impactful security issues in recent memory." It added that the same AI capabilities "can also help attackers rapidly develop offensive tools and exploits."

Wiz researchers said the underlying bugs had been present for decades. Turning them into a working exploit required an exceptionally complex chain of steps, and frontier AI models substantially lowered that barrier, according to Wiz.

Sites pulled offline

Several sites took themselves down rather than wait. Pinboard, parts of Wikipedia, 4Chan and Something Awful were offline Wednesday morning, citing fear of takeover. ITmedia reported that Japanese sites, including systems for daycare centers and video games, also went dark voluntarily.

The UK's National Cyber Security Centre is urging organizations to consider taking offline any system that cannot be fixed right away. European authorities have made a similar recommendation, according to NBC News.

Security consultant Lukasz Olejnik of King's College London said, "This is not a drill." His worst case is "wormable malware affecting big chunks of the internet." Researcher Kevin Beaumont said the situation "will lead to a mass of incidents."

What admins need to do

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. "There are no complete mitigations, updating is the only safe choice," the PHP Foundation wrote in its advisories.

Updating WordPress or Laravel does not update the PHP runtime underneath it. That comes from the server package, the host or the container image. After updating, restart Apache, PHP-FPM and any long-running PHP workers.

Linux distributions and long-term-support vendors received the patches in advance. A distribution package can carry the fix under an old-looking version number. Debian advises checking the package changelog for the CVE rather than the version string.

Admins who install PHP from the volunteer-run Remi repository (rpms.remirepo.net) are out of luck for now. PHP said the repository would not publish updates today, and urged users to switch to distribution packages or build from source.

Sansec offers a partial stopgap: block multipart/form-data requests at the web server so PHP never parses them. It stresses this only buys time and is no substitute for the patch.

Patchstack and Wiz say application logs may show little, because the flaws act below the application layer. Patchstack advises treating any unpatched server as potentially compromised and considering rotating the credentials it holds.

The unpatchable tail

PHP supports only versions 8.2 and newer, and 8.2 reaches end of life on Dec. 31, 2026. For PHP 8.1 and older, the project published minimal source backports for 7.4, 8.0 and 8.1. Some distributions and vendors offer their own backported fixes.

That leaves a lot of servers nobody is tending. "So many embedded installations out there that will never be patched. Too many forgotten, unmaintained apps. There will be a long tail for this one," said computer forensics expert Hal Pomeranz.

How many of those systems get hit in the coming days is the open question.