PHP developers have released emergency security patches for two critical vulnerabilities after governments and major websites temporarily shut down services to protect themselves from cyberattacks.
Issued on Wednesday, 21 October, the fixes are included in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The vulnerabilities, known collectively as PHP2Shell, could allow attackers to execute malicious code on vulnerable servers without needing a password or other access credentials.
The flaws, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 out of 10 under the Common Vulnerability Scoring System.
The scale of potential exposure is enormous. PHP powers 69.3% of websites whose server-side programming language can be identified, according to W3Techs, although not all those websites are necessarily vulnerable.
Across Europe, authorities took government portals, hospital websites and other public services offline as a precaution. The Port of Rotterdam, Dutch government websites and services operated by Finland's state IT provider were among those affected, Reuters reported.
The disruption extended beyond government. The Wikimedia Foundation, which operates Wikipedia, temporarily suspended several supporting services, while the Internet Archive also briefly went offline. These were protective measures, not evidence that the organisations had been hacked.
Attack attempts were already being detected before the patches were released. Cybersecurity company Cloudflare introduced emergency firewall protections and reported that attackers were modifying malicious requests in attempts to evade detection.
Security firms watchTowr and Hadrian also observed exploitation attempts. Hadrian reported attacks occurring at scale, while working proof-of-concept exploits had begun circulating online.
Crucially, researchers have demonstrated that the vulnerabilities can be exploited successfully. Wiz Research achieved remote code execution against test installations of WordPress, Drupal and Joomla, demonstrating how attackers could potentially take control of vulnerable web servers.
However, successful exploitation in security research is not the same as a confirmed criminal intrusion. Although malicious activity has been observed in the wild, no independently verified case of a production website being compromised through PHP2Shell has yet been established in the reports examined.
The vulnerabilities involve failures in PHP's memory handling. Particularly exposed are servers using Apache's mod_php, a module that runs PHP directly inside the Apache web server. Researchers demonstrated that one flaw could be exploited through a malicious web request before the website's own application code runs.
The PHP Foundation has acknowledged that signs of one underlying problem were identified in 2024, but efforts to resolve it stalled. Subsequent AI-assisted research helped expose the full danger, prompting an emergency response from developers.
Linux distributions, including Ubuntu and Debian, have released corrected packages. However, servers running older, unsupported PHP versions may require vendor-supplied fixes or an upgrade to a supported release.
PHP developers have issued an unequivocal warning: "There are no complete mitigations, updating is the only safe choice." Firewall protections and configuration changes cannot guarantee safety, and updating WordPress or another content management system does not patch the underlying PHP installation.
Administrators are being urged to install the security updates immediately and investigate any suspicious activity on systems that may have been exposed before patching.
