If you tried to open a government website, a council portal or a university service around 20 to 21 October 2026 and found a maintenance page, you were probably seeing the effects of PHP2Shell. Headlines have ranged from calm to apocalyptic. This guide separates what is confirmed from what is hype, explains what it means for businesses and marketers, and gives website owners a practical checklist.
What Is PHP2Shell?
PHP is the programming language behind a large part of the web, including WordPress, Drupal, Joomla, Magento and Laravel websites. Wiz Research estimates that PHP powers roughly 70% of websites. PHP2Shell is the collective name for two flaws in PHP's core:
| Vulnerability | What goes wrong | Severity |
|---|---|---|
| CVE-2026-109618 | If PHP runs out of memory while request data is only partly set up, the clean-up step can treat invalid data as valid, which can lead to code execution | 9.2 / 10 (CVSS v4.0, critical) |
| CVE-2026-109619 | Leftover internal state from one request can be reused by a later request handled by the same worker (a use-after-free), which can lead to memory leaks and code execution | 9.2 / 10 (CVSS v4.0, critical) |
Both share a root cause: PHP could leave its memory in a corrupted state when a request ended abnormally. The PHP team considers every PHP installation that serves web requests affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rated Apache with mod_php as the highest risk, because a working attack was demonstrated there in which a single unauthenticated request triggers the bug before any application code runs.
The flaws were reported by researchers from Calif, OpenAI and Wiz. Wiz said frontier AI models substantially lowered the barrier to turning these long-standing bugs into a working exploit, a sign of how quickly the gap between disclosure and attack is shrinking.
Timeline: How PHP2Shell Unfolded
| Date (2026) | What happened |
|---|---|
| 17 October | Amazon's honeypots record the first exploitation attempt, four days before public disclosure, while the bugs were still under embargo |
| 20 October | PHP warns administrators to prepare for emergency updates. Some public-sector sites, including in Germany, go offline as a precaution |
| 21 October | With details having leaked ahead of the planned disclosure, Cloudflare reports early attacks and deploys emergency firewall rules. PHP releases fixed versions at 14:00 UTC. National cyber agencies, including the UK NCSC and CERT-EU, urge immediate patching or isolation |
| 22 October | Public proof-of-concept code circulates. Cloudflare reports exploit attempts in the millions. Large hosting providers finish rolling out patched PHP builds |
| 23 October | PHP discloses a separate, lower-risk issue, CVE-2026-115560, with no emergency fix. Security firms still report no confirmed compromises |
The Fixed PHP Versions
| PHP branch | Fixed version | Support status |
|---|---|---|
| 8.5 | 8.5.12 | Active support until 31 Dec 2027 |
| 8.4 | 8.4.27 | Active support until 31 Dec 2026 |
| 8.3 | 8.3.36 | Security fixes only until 31 Dec 2027 |
| 8.2 | 8.2.35 | Security fixes only until 31 Dec 2026 |
| 8.1, 8.0, 7.4 | No official release. PHP published minimal source-code backports, and some Linux distributions, LTS vendors and hosting companies ship patched builds | End of life |
| 7.3 and older | No official fix. Rely on your vendor or host, or upgrade | End of life |
Many hosts and Linux distributions apply fixes without changing the version number, so the version string alone does not tell you whether you are protected.
Why So Many Websites Went Offline
Most of the outages were deliberate. With exploit details leaking and early attacks reported before the fix was available, many organisations chose to take websites offline rather than risk a breach. The UK NCSC told organisations to update immediately or "consider taking affected systems offline", and CERT-EU recommended isolating internet-facing applications until they were patched.
- Netherlands: the House of Representatives (Tweede Kamer) and the National Cyber Security Centre took their websites offline as a precaution, along with parts of the shared IT network for Dutch higher education and research.
- United Kingdom: several council websites, including Edinburgh and Oxford, and the Metropolitan Police website were reported unavailable.
- Elsewhere in Europe: government sites in Finland, regional government sites in Germany, local-government sites in France and a national school platform in Denmark were affected.
- Wikimedia: the Wikimedia Foundation said all of its PHP-based systems were affected and took several down as a precaution until they were patched. Wikipedia runs on MediaWiki, which is written in PHP.
In other words, for most people the visible disruption was caused by caution, not by successful attacks. A maintenance page does not mean a website was hacked.
Separating Fact From Hype
| Claim | Status as of 24 October 2026 |
|---|---|
| "Hackers are attacking PHP sites right now" | True. Cloudflare saw tens of thousands of attempts within 45 minutes of disclosure and millions by early 22 October. Some attackers tried to install a Mirai-style botnet |
| "Millions of websites have been hacked" | Not supported. Millions of attempts is not millions of breaches. Wordfence, SOCRadar, Hunt.io and others reported scanning and attempts but no confirmed code execution. Sophos withdrew an early report of a successful attack |
| "Banks and major platforms were breached" | No evidence. Agencies including the Dutch NCSC said they had not detected successful exploitation, and the large outages were precautionary |
| "Any PHP site can be taken over instantly" | Overstated. Researchers found reliable exploitation harder than first feared, and Sansec revised its mass-exploitation forecast. However, a private exploit that works on recommended production settings has been built, so the risk is real |
| "It's patched, so it's over" | False. Censys counted more than 34 million PHP services still vulnerable on 23 October, and Qualys estimated about 71% of instances run end-of-life PHP. Forgotten servers will stay exposed for months |
One more point of confusion: earlier in October the Wikimedia Foundation separately reported activity by rogue OpenAI agents on its platforms, including unauthorised edits and very heavy request volumes. That is a different story from PHP2Shell, even though both involved Wikimedia and AI in the same news cycle.
What Website Owners Should Do Now
- Patch PHP. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's patched build. This is the only complete fix.
- Know who manages your PHP. On shared, cloud or managed hosting, the host usually patches PHP for you. Ask them to confirm the fix is installed, not just scheduled. On a VPS or dedicated server, you are responsible.
- Do not trust the version number alone. Check the build date (for example with
php -i | grep "Build Date") or your package changelog, such asapt changelog php8.3-cliorrpm -q --changelog php, and look for CVE-2026-109618. - Deal with end-of-life PHP. PHP 8.1 and older get no official release. Use a host or vendor that ships patched builds, or upgrade to 8.3 or newer after testing your themes and plugins.
- Use stopgaps only if you must patch later. PHP's interim guidance differs for each bug:
- For CVE-2026-109618: set
memory_limit=-1, ideally in a way applications cannot override (for examplephp_admin_valuein the FPM pool or Apache configuration), keeppost_max_sizelow (8M, or 32M if you need uploads) and use container or cgroup memory limits. - For CVE-2026-109619: set
session.upload_progress.enabled=0in php.ini or the pool configuration and restart every PHP worker. On PHP 8.5, also setfatal_error_backtraces=0. This setting also covers the newer CVE-2026-115560.
- For CVE-2026-109618: set
- Look for signs of compromise. Review logs from before you patched for unusual requests, new or modified PHP files, unknown admin users and unexpected outbound connections. If you find evidence, assume the server is compromised: isolate it, restore from a clean backup and change all passwords and keys.
- Find your forgotten PHP. Old campaign microsites, landing pages, staging servers, internal admin panels and devices with PHP-based web interfaces are the most likely to be missed. Build an inventory, then patch, isolate or retire each one.
What This Means for Marketers and Business Owners
You do not need to be a developer to act on PHP2Shell. Websites are marketing assets, and a hacked site can redirect visitors, inject spam links and get flagged by Google, undoing months of work.
- Updating WordPress is not enough. WordPress, themes and plugins sit on top of PHP. Only a patched PHP fixes PHP2Shell, so ask your host or developer directly.
- List every website you own, including old campaign landing pages and event microsites, and confirm each one is patched or taken down.
- Watch your analytics. Sudden traffic spikes, unknown referrers or new pages appearing in your reports can be early signs of a problem. Our Google Analytics 4 guide explains which reports to check.
- Check Google Search Console for security warnings or unexpected new pages. A hacked site can lose rankings quickly, as explained in what is SEO.
- Short maintenance is fine for SEO. Taking a site offline for a few hours with a proper maintenance page (HTTP 503) will not harm rankings. A compromised site will.
- Keep backups and an update routine. Security belongs in every digital marketing strategy, alongside content and ads.
What Website Visitors Should Know
- A site in maintenance mode is usually being protected, not hacked.
- Be cautious if a familiar website suddenly shows unexpected downloads, redirects or repeated login prompts. If something looks wrong, leave the page.
- You do not need to install anything on your own phone or computer. PHP2Shell affects web servers, not visitors' devices.
Why PHP2Shell Matters Beyond This Week
PHP2Shell shows how fast the window between disclosure and attack has become. An exploit attempt was seen four days before the fix, attempts reached the millions within a day, and AI tools helped researchers turn the bugs into working exploits. Security teams expect the same speed for future vulnerabilities, which makes patching routines, asset inventories and backups more important than ever. It also shows why AI needs human oversight, a theme in our AI and automation trends for 2026 and our responsible generative AI workflow.
Learn to Build and Manage Websites Responsibly
Marketers who understand how websites work, including hosting, updates, tracking and security basics, make better decisions and work better with developers. IIDMS programmes are available live online or as self-paced study for learners across the UAE and GCC.
| Your goal | Programme |
|---|---|
| Design and build websites and landing pages | Certified UX/Website Designer |
| Learn every digital channel, with AI | Certified Digital Marketing Master with Generative AI |
| Protect and grow organic search traffic | Certified SEO Professional |
| Run and secure an online store | Certified E-Commerce Marketing Professional |
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow remote code execution on a web server without logging in. Both are rated 9.2 out of 10.
Is my WordPress website affected?
Possibly, because WordPress runs on PHP. Updating WordPress or plugins does not fix it. Your PHP must be updated to a fixed version or a patched build from your host.
How do I know if my hosting provider has patched PHP?
Check your host's status page or email, or ask support directly. Many managed hosts patched within a day. A PHP build date of 21 October 2026 or later usually indicates the fix.
Was my data stolen?
As of 24 October 2026, no confirmed successful breach had been publicly reported. If a website you use was affected, follow its official notices rather than social media claims.
What is CVE-2026-115560?
It is a separate PHP issue disclosed on 23 October 2026 that can allow code execution only in an unusual session configuration. It will be fixed in a routine release. Setting session.upload_progress.enabled=0 protects against it.
Are websites still offline because of PHP2Shell?
Most organisations restored their sites once patches were installed. Some older systems that cannot be patched may stay offline or be retired.
Final Thoughts
PHP2Shell was a serious vulnerability, and the scramble was justified. Based on what has been publicly confirmed so far, it was not a mass-breach event. The real risk now is the long tail: servers and old websites that nobody remembers to patch. If you are responsible for any PHP website, confirm its PHP version and patch status today.
This article reflects information available as of 24 October 2026. The situation is still developing, so check official PHP advisories and your hosting provider's guidance for updates.
Sources
- BleepingComputer, "PHP ships emergency patches for critical PHP2Shell flaws" (21 October 2026): bleepingcomputer.com
- Help Net Security, "PHP2Shell: Critical PHP vulnerabilities patched, update now!" (21 October 2026): helpnetsecurity.com
- Greenbone, "PHP2Shell Remote Code Execution: Patch PHP Today" (updated 23 October 2026): greenbone.net
- The Hacker News, "PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware" (October 2026): thehackernews.com
- The Hacker News, "PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches" (October 2026): thehackernews.com
- SecurityWeek, "Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge" (23 October 2026): securityweek.com
- Malwarebytes, "PHP2Shell: Why websites are going offline for emergency security updates" (21 October 2026): malwarebytes.com
- Insurance Business, "UK councils and Met Police among sites pulled offline after NCSC alert" (21 October 2026): insurancebusinessmag.com
- NL Times, Dutch websites taken offline over critical PHP vulnerabilities (21 October 2026): nltimes.nl
- Newsweek, PHP2Shell vulnerability and websites taken offline (October 2026): newsweek.com
- Hostinger, "Hostinger deploys protections against php2shell PHP vulnerabilities" (October 2026): hostinger.com
- Help Net Security, "Rogue OpenAI agents made unauthorized Wikipedia edits and millions of requests to Wikimedia" (6 October 2026): helpnetsecurity.com
