# PHP2Shell: 5 Facts on the CVSS 9.2 PHP Flaw [2026] > Source: > Published: 2026-10-24 13:30:25+00:00 The PHP security flaw that dominated this week’s headlines is real, severe, and already fixed. It has not broken the internet. PHP disclosed two critical core vulnerabilities on October 20, 2026, and shipped patches on October 21 at 13:30 UTC, according to the [CERT-EU security advisory](https://cert.europa.eu/publications/security-advisories/2026-018/). Both bugs can enable unauthenticated remote code execution, and both carry a CVSS score of 9.2. Search interest around the nickname [php2shell](https://shattered.io/php2shell-2-cves-google-openai-ai-tools-2026/) has surged since then, and so has the hype. This analysis breaks the story into the five things that matter, separates what outlets confirmed from what they only implied, and closes with a patch checklist. Governments, universities and media groups [pulled sites offline as a precaution](https://shattered.io/php2shell-governments-pull-websites-offline-2026/), which tells you how seriously defenders took the first days of the disclosure. Don't miss new tech stories on Google Add Shattered once in the Google app and our stories show up in your news suggestions. [Add now](https://www.google.com/preferences/source?hl=en&q=https%3A%2F%2Fshattered.io%2F) ## The 5 Things to Know About the PHP Security Flaw Readers who only have a minute should start here. Each point below gets its own section later, with sourcing and caveats. 1. **Two bugs, one outcome.** CVE-2026-109618 involves memory corruption during out-of-memory handling, and CVE-2026-109619 involves stale global state. Both can lead to unauthenticated remote code execution. 2. **Patches exist.** The PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Patching requires action from administrators or hosting providers. 3. **Exploitation reporting conflicts.**[BBC reported no successful exploits](https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o) so far, while[NBC News reported](https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-update-systems-rcna604751) that hackers had reportedly started exploiting the bugs. Treat the picture as unsettled. 4. **Authorities told sites to patch or go dark.** The NSA, FBI and CISA urged organizations to fix the flaws or take unpatched systems offline. 5. **The scope is large but not universal.** Vulnerable PHP installations that accept requests from untrusted networks are the confirmed risk. Claims that every website is affected are not supported. ## Thing 1: Two Critical PHP Core Vulnerabilities, One Shared Danger The php2shell name covers two separate defects in the PHP core, the engine that executes PHP code on a web server. Wiz Research and Google both described the flaws as capable of exposing applications to unauthenticated remote code execution and memory disclosure, a point laid out in the [Google Cloud response post](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619). Unauthenticated means an attacker needs no username or password. Remote code execution means the attacker can run commands on the server from afar. That combination sits at the top of any severity scale. A flaw that needs a login is a problem for sites with open registration. A flaw that needs no login is a problem for everyone who exposes the software to the internet. Both CVEs received the same 9.2 CVSS score, which reflects that shared profile. | CVE | Root cause | CVSS | Worst-case outcome | |---|---|---|---| | CVE-2026-109618 | Memory corruption during out-of-memory handling | 9.2 | Unauthenticated remote code execution | | CVE-2026-109619 | Stale global state | 9.2 | Unauthenticated remote code execution | ### CVE-2026-109618: When PHP Runs Out of Memory PHP caps how much memory a request may use. When a request blows past that limit, PHP aborts it. CERT-EU explained that this abort can interrupt the engine while internal request data is only partly set up, for example while it parses a file upload. Cleanup code then treats the half-built data as valid and tries to free memory that was never initialized. That memory can still hold leftovers from earlier allocations that an attacker influenced. ### CVE-2026-109619: The Request That Leaves Debris Behind The second bug works on a different timeline. According to CERT-EU, internal state owned by one request can survive after the memory behind it has been freed, such as after a fatal error. A later request handled by the same worker may then read that stale state before the normal reset happens. Memory-safety bugs of this kind are hard to spot in review, which matters for the AI discovery story covered below. ## Thing 2: Which PHP Versions Are Affected and Which Releases Fix Them The PHP team shipped four fixed releases on October 21. Affected versions include PHP 8.4 builds before 8.4.27, PHP 8.3 builds before 8.3.36, and PHP 8.2 builds before 8.2.35. The 8.5 line gets its fix in 8.5.12. The table below maps each branch to its fix so administrators can check a running server in seconds. | PHP branch | Fixed release | Status in the advisories reviewed | |---|---|---| | PHP 8.5 | 8.5.12 | Upgrade to the fixed release | | PHP 8.4 | 8.4.27 | Versions before 8.4.27 are affected | | PHP 8.3 | 8.3.36 | Versions before 8.3.36 are affected | | PHP 8.2 | 8.2.35 | Versions before 8.2.35 are affected | | Older branches | No upstream release named | Ask your Linux distributor or long-term support vendor for adapted fixes (per Nextgov) | [Nextgov reported](https://www.nextgov.com/cybersecurity/2026/10/us-agencies-urge-fixes-programming-language-flaws-putting-millions-web-systems-risk/416726/) that PHP’s developers told organizations on Linux distributions or long-term support services to check their vendors for updated packages, including fixes adapted for older versions. That detail matters because plenty of production servers run a distribution’s packaged PHP rather than a build from php.net. A server can sit on a branch the table does not list and still be exposed. CERT-EU also warned that many commercial and open-source products use PHP as a backend technology. Those products could be affected even when they do not expose a PHP installation directly. An appliance or admin panel with PHP inside it needs a vendor patch, and the vendor sets the timeline. Our earlier look at [NAS devices and the vendor patch gap](https://shattered.io/php2shell-nas-devices-vendor-patch-gap-cvss-9-2-2026/) shows how that lag plays out on consumer and small-office hardware. ## Thing 3: The Exploitation Picture Is Still Contradictory Here the reporting splits, and honest coverage has to say so. BBC reported on October 22, with an update a day later, that there had been no reports of any successful exploits of php2shell so far. Nextgov cited a CISA blog post saying the agency had not observed exploitation at the time of publication. By contrast, NBC News carried a subhead saying hackers had reportedly started exploiting the flaws already. Those statements can all be true at once. An attempt is not a success, a honeypot hit is not a victim, and a rumor is not a confirmed intrusion. AFP reported that Amazon Threat Intelligence identified a hacking attempt carried out before the flaws became public, describing it as the targeting of a honeypot from an anonymized connection. A honeypot is a decoy server built to attract attackers, so that event shows interest in the bugs, not a breached business. CERT-EU struck a more cautious note. It said technical details were being discussed publicly and that initial proofs of concept had begun to circulate, which raises the likelihood that attackers are already exploiting the vulnerabilities. We covered the early-attack claims in a separate report on [attacks that allegedly began before disclosure](https://shattered.io/php2shell-attacks-began-4-days-before-disclosure-2026/), and the fair reading is that the evidence remains inconsistent. No outlet in this review documented a named organization breached through php2shell. For defenders, the practical answer is the same under every scenario. Public proof-of-concept code lowers the skill needed to attack. Patch first and debate the exploitation count later. ## Thing 4: Why Governments and Hosts Reacted So Fast The response looked unusual because agencies rarely tell organizations to switch things off. Nextgov reported that the NSA, FBI and CISA urged organizations on Wednesday to fix the flaws, warning that systems should come offline if they cannot be secured promptly. NBC News reported that US, European and British authorities recommended websites temporarily go offline until they were fixed. AFP added that the call was echoed by authorities from China to the European Union. Three factors drove that stance. First, the bugs need no credentials. Second, Nextgov reported that under certain setups an attack can land before the website’s own code even executes, so careful application security alone does not help. Third, a leak compressed the schedule. Nextgov, citing cybersecurity firm Huntress, said a post on Hacker News surfaced on Tuesday morning and was later removed, though screenshots spread. PHP’s developers then moved the fixes up a day, which left site operators little time to prepare. The visible fallout was operational rather than catastrophic. BBC listed the Finnish government, Edinburgh council, some BBC pages, and Wikimedia systems among those taken down as a precaution. It also reported that many sites were back up by Thursday while others were still going offline temporarily as organizations checked their exposure. AFP counted government agency sites in countries from Australia to Finland, insurance firms, transport operators and media outlets among those in emergency maintenance. Small operators face a different problem, which we unpacked in [why small businesses should care about php2shell](https://shattered.io/what-php2shell-is-and-why-small-businesses-should-care/). A large agency has a change-management team and an on-call rota. A shop owner with a shared hosting plan has a login page and a hope that the host patches on schedule. ## Thing 5: Does the Label Breaking the Internet Hold Up? Not as stated. The phrase breaking the internet appears in social posts and headlines, but none of the outlets reviewed here confirmed that the internet broke. What they confirmed is narrower and still serious: a critical flaw in widely used server software, a coordinated scramble to patch it, and a wave of precautionary outages. Scope deserves precision too. The confirmed technical scope is vulnerable PHP installations, particularly those that accept requests from untrusted networks. AFP made a related point, reporting that only sites running PHP on their own servers are exposed, and that many large platforms built on other languages, or run by operators able to install the fix fast, stayed online. Claims that all websites or all PHP installations fall to this bug go beyond the evidence. No outlet in this review confirmed a count of affected sites, servers or users, and the sources that attempted estimates differed by method. Censys researcher Silas Cutler told NBC News that scoping would sharpen in a few days, because defenders were still working out how to move from assuming everything was vulnerable to knowing what was. This article does not repeat any exposure total for that reason. The honest summary is that the potential impact is very large because PHP sits under so many sites, while the confirmed impact so far is outages, urgent patching and a few exploitation signals. Both halves of that sentence are true, and good coverage keeps them apart. ## How AI Changed the Discovery Story One reason this PHP security flaw drew mainstream attention is how it was found. BBC framed the story around artificial intelligence, reporting that serious flaws had gone undetected for more than a decade in technology underpinning much of the internet, and that it took AI to bring them to light. AFP reported that security firm Calif found the flaws in an OpenAI-funded audit of PHP’s code, and that Wiz, which Google owns, found them independently weeks later with help from AI models. OpenAI said, per AFP, that the discovery marks a new phase in which AI can find security bugs with internet-scale impact. Paul Spain, chief executive of Gorilla Cyber Security, told the BBC that AI could also make attacks easier and faster. That dual-use tension drives much of the policy conversation, and Japan has already moved on it with an [AI attack simulation team aimed at PHP flaws](https://shattered.io/japan-ai-cyberattack-simulation-team-php-flaws-2026/). AFP added context on the broader trend: the number of software vulnerabilities discovered worldwide in 2026 is on track to roughly double last year’s record total. If that holds, defenders face a steady stream of high-severity disclosures in mature code, and patch pipelines built for a slower era will struggle. Responsible disclosure also took a hit. AFP reported that the flaws had been reported privately to PHP’s developers and kept confidential while a fix was prepared, until details leaked a day before the planned release. The lesson for maintainers is that embargoes get harder to hold when more parties, human and machine, can find the same bug. ## Historical Context: Patch Scrambles That Came Before Security people reached for comparisons within hours. AFP reported that Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal this was the most serious problem PHP had faced in more than a decade, and compared it to Heartbleed, the 2014 flaw that set off a worldwide rush to patch. The Wiz blog went further, according to AFP, ranking the findings among the most severe ever discovered in PHP and arguably in software history. Comparisons help but also mislead. Heartbleed leaked memory from servers running a specific encryption library. Log4Shell, in late 2021, let attackers run code through a ubiquitous Java logging library. Php2shell echoes both. It touches memory handling like Heartbleed, and it promises code execution like Log4Shell. What differs is the layer: this time the weak point is the language runtime itself, one level below the application code that most teams audit. Nextgov captured the implication clearly. An organization could have carefully secured its own code and still be exposed through the PHP software running it. That inverts the usual advice to harden your application, because the application was never the problem. History also offers a sober reminder about the long tail. After past mass-patch events, unpatched systems lingered for months or years, and attackers kept scanning for them. Kerrison of James Cook University’s Singapore campus warned AFP that some sites and people would have no idea about the bug for days, weeks and months. Our [security coverage hub](https://shattered.io/security/) tracks how those long tails tend to unfold. ## Market Impact: Who Pays the Cost of Php2shell No outlet in this review reported a financial loss, ransom demand or payment tied to the vulnerabilities, so any dollar figure circulating online lacks support here. The market effects visible today are operational and reputational, and they fall unevenly across four groups. **Hosting providers and managed platforms** carry the heaviest load. They must patch fleets, test for regressions and field customer tickets, all within days. Providers that already automate runtime updates look good this week, while those that rely on customers to upgrade look slow. Expect buyers to ask about patch service levels in the next contract round. **Security vendors** gained a showcase. Google Cloud published a response post, CERT-EU and other national bodies issued advisories, and vendors competed to announce detection and protection content. That marketing push is predictable, but it also gives defenders usable guidance, so the net effect is positive. **Enterprises and agencies** absorbed planned and unplanned downtime. BBC reported the UK government said limited services might be offline temporarily, and France’s Orange suspended access to certain services globally while deploying fixes. Those are real costs, though they are the price of acting before attackers do. **Small site owners and device makers** face the least visible risk. They lack monitoring, and many depend on third-party firmware or plugins that embed PHP. The gap between the best-prepared and least-prepared operators is the real market story, and it will widen if vendors slow-walk fixes. ## Competitive Comparison: How the Main Sources Framed the Risk Reading the coverage side by side shows where the story is solid and where outlets diverge. The table summarizes what each source said about exploitation and what it told organizations to do. | Source | On exploitation | Guidance to organizations | |---|---|---| | BBC (Oct. 22, updated Oct. 23) | No reports of any successful exploits so far | Check whether sites are affected, patch, or consider going offline | | NBC News (Oct. 21) | Subhead said hackers had reportedly started exploiting | Authorities recommended temporary offline status until fixed | | Nextgov (Oct. 21) | CISA had not observed exploitation at time of publication | NSA, FBI and CISA urged fixes or offline status | | CERT-EU advisory | Proofs of concept circulating, raising the likelihood of exploitation | Patch immediately, isolate internet-facing apps if patching is not feasible | | AFP (Oct. 23) | Amazon Threat Intelligence reported a pre-disclosure attempt on a honeypot | NSA told organizations to patch immediately or pull systems offline | | Google Cloud blog | Described exposure to remote code execution and memory disclosure | Published a response guide for the two CVEs | The pattern is clear. Government sources lean on the absence of observed exploitation yet still demand urgency. News outlets differ on tone because they emphasize different evidence. Technical advisories like CERT-EU’s assume the worst because proofs of concept exist. None of these framings contradicts the core facts, which is why a patch-now stance holds across all of them. One more wrinkle: CERT-EU’s advisory has since added a note about a further, separate PHP issue that the PHP team considers an unlikely risk. Treat that as an ongoing item rather than part of php2shell, and watch the advisory for updates. ## What To Do Now: A Patch and Verification Checklist The sequence below follows the guidance in the CERT-EU and Nextgov reporting. It assumes you run PHP yourself or manage servers that do. If you only use a hosted site, ask your provider the same questions and get answers in writing. 1. **Inventory.** List every server, container and appliance that runs PHP, including admin panels and vendor products that embed it. 2. **Check versions.** Compare each running version against the fixed releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 3. **Upgrade or install vendor packages.** Use the upstream release, or your distributor’s patched package if you run a packaged build. 4. **Restart PHP workers.** A package upgrade does not help if old processes keep running. Restart PHP-FPM, Apache or whichever server hosts PHP. 5. **Isolate what you cannot patch.** CERT-EU advises isolating internet-facing resources from public networks until a verified fix is in place. 6. **Review logs.** Look at web server, PHP, process and outbound network logs for odd requests or post-exploitation behavior. 7. **Verify.** Confirm the running binary reports the fixed version after deployment. These commands help confirm what a Linux server actually runs. Adjust them for your distribution and web server. ``` php -v php-fpm -v apachectl -M | grep -i php dpkg -l | grep -i php rpm -qa | grep -i php ``` Teams that lack a log pipeline can start small. A tool like CrowdSec blocks known bad IPs at the firewall, and our walkthrough on [setting up CrowdSec on Ubuntu](https://shattered.io/crowdsec-ubuntu-firewall-bouncer-setup-2026/) covers it in about 45 minutes. It will not fix php2shell, since only an update fully fixes these vulnerabilities, as CERT-EU stressed. It does cut noise from opportunistic scanners while you patch. ## Five Predictions for the Next Few Weeks These are analyst judgments based on the reporting above, not confirmed events. Treat them as scenarios to plan around. 1. **Exploitation reports will rise.** Public proof-of-concept code and wide scanning make confirmed incidents more likely over time. The current gap between BBC’s no-exploit line and NBC’s reported-exploitation line will probably close in favor of confirmed attacks on unpatched sites. 2. **The long tail will linger.** Unmanaged blogs, abandoned shops and embedded appliances will stay vulnerable long after large organizations finish patching. Expect attackers to focus there. 3. **AI-assisted audits of core open-source runtimes will multiply.** If one audit surfaced decade-old flaws, maintainers of other widely used projects will face the same scrutiny, from friendly researchers and hostile ones. 4. **Hosts will market automatic runtime patching.** Providers that patched quickly will turn that into a selling point, and laggards will face customer pressure. 5. **Policy will reference this event.** Agencies that told sites to go dark will likely cite php2shell when they revisit patch deadlines for internet-facing software, including the kind tracked in federal known-exploited lists. Our[CISA KEV tracker build](https://shattered.io/cisa-kev-tracker-python-12-steps-2026/) shows one way to monitor those lists yourself. ## What Remains Unconfirmed A responsible news analysis lists its gaps. Several claims circulating online do not hold up against the sources reviewed for this piece. - **That the flaw is breaking the internet.** No outlet confirmed this. Confirmed effects are outages, urgent patching and heightened alerts. - **That all websites or all PHP installations are affected.** The confirmed scope is vulnerable PHP installations, particularly those accepting requests from untrusted networks. - **That successful exploitation has occurred at scale.** BBC reported no successful exploits so far. NBC News and CERT-EU pointed toward early or likely attacks. The record is inconsistent. - **Any specific number of affected sites, servers, organizations or users.** Sources used different counting methods, and Censys indicated scoping would take days. - **Any financial loss, ransom demand or payment.** None appeared in the reporting reviewed. We will update this analysis if outlets confirm named victims, official exposure numbers or new fixes. Until then, the defensible position is simple: the flaw is critical, the fix exists, and the hype outruns the evidence. ## Frequently Asked Questions **What is the PHP security flaw called php2shell?** Php2shell is the nickname for two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP disclosed them on October 20, 2026. Both can enable unauthenticated remote code execution and carry a CVSS score of 9.2. **Which PHP versions fix the vulnerabilities?** The PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, at 13:30 UTC. Running 8.4 before 8.4.27, 8.3 before 8.3.36, or 8.2 before 8.2.35 leaves you affected. **Are hackers exploiting the PHP flaw right now?** Reporting conflicts. BBC said no successful exploits had been reported so far, and CISA told Nextgov it had not observed exploitation when that story ran. NBC News reported that hackers had reportedly started exploiting the bugs, and CERT-EU said circulating proofs of concept raise the likelihood of attacks. Patch as if exploitation is underway. **Is my website affected?** Only if it runs on a vulnerable PHP installation, and the risk is highest for installations that accept requests from untrusted networks. AFP reported that only sites running PHP on their own servers are exposed. Ask your host whether it has applied the fix, or check your own PHP version with the commands shown above. **Do patches install automatically?** Not by default on self-managed servers. Administrators must upgrade PHP or install patched packages from their distributor, hosting provider or appliance vendor, then restart services and confirm the running version. **Why did governments tell some sites to go offline?** The bugs allow code execution without a login, a leak shortened the disclosure schedule, and unpatched systems face real risk until updated. Nextgov reported that the NSA, FBI and CISA urged organizations to fix the flaws or take systems offline if they could not secure them promptly. **How did researchers find the vulnerabilities?** BBC and AFP reported that AI tools played a central role. Calif found the flaws during an OpenAI-funded audit of PHP’s code, and Wiz reported finding them independently with help from AI models. **Does this affect WordPress sites?** WordPress runs on PHP, so a WordPress site on an unpatched PHP runtime is exposed. Nextgov reported that Wiz demonstrated successful attacks against WordPress, Drupal and Joomla installations. The fix sits at the PHP level, so updating WordPress alone does not solve it.