PHP2Shell: The PHP Security Flaw That Took Websites Offline Worldwide

What happened

On Wednesday 21 October 2026, the PHP Foundation released an emergency patch for two critical flaws in PHP, the language behind roughly 70% of the world's websites. The pair, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, scored 9.2 out of 10 on the CVSS severity scale.

Both bugs let an attacker run code on a web server without logging in. One abuses how PHP handles running out of memory; the other exploits leftover state after a request crashes. They sat undetected in the PHP codebase for more than a decade and were finally uncovered with the help of AI tools by researchers at Calif and Wiz, working alongside the PHP Foundation and OpenAI.

The disclosure was meant to be orderly, but details leaked on social media on Tuesday and forced an early release. Governments and organisations responded by pulling sites offline: Finland's public web services, the Dutch parliament and cyber-security agency, councils in Edinburgh, Bristol and Oxford, parts of Wikipedia, and several BBC programme pages all went dark as a precaution. The Australian Signals Directorate's own site was affected overnight.

Why it matters to you

If your website runs WordPress, Drupal, Joomla, Magento or sits on shared hosting, it almost certainly runs PHP, even if nobody ever told you. PHP also hides inside control panels, appliances and third-party products, which is why security teams say the hard part is not installing the patch but finding every place it needs to go.

A successful attack gives criminals a direct line to your server's files and database. From there they can steal data, plant malware, install a hidden backdoor, run crypto-miners at your expense, or use your server to attack others. The US NSA and the UK's NCSC have both told organisations that cannot patch straight away to take affected systems offline until they can.

The clock is already running. Cloudflare reported early attack attempts within hours of the patch, and Amazon saw a probe against one of its decoy systems four days before public disclosure. Because the fix is public and AI tools can reverse-engineer it quickly, experts expect automated, large-scale scanning of every exposed PHP server. The sites most at risk are the ones that are rarely maintained, and attacks on those are likely to continue for weeks or months.

What to do now

1. Find out what you run. List every website, web app, hosting account and appliance you own, and check which ones run PHP and which version. Ask your hosting provider or web developer if you are unsure.
2. Patch immediately. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Anything on PHP 8.1 or older has no fix and must be upgraded to a supported branch.
3. Restart and rebuild. The patch only takes effect once PHP worker processes (PHP-FPM, Apache mod\_php, php-cgi, FrankenPHP, LiteSpeed) are restarted. Container images must be rebuilt.
4. Isolate what you cannot patch. If a fix is not possible today, take the site offline or cut it off from the public internet until it is.
5. Check for a break-in. Look for unfamiliar files, new admin accounts, unexpected scheduled tasks or outbound connections. Attackers may already have a foothold.
6. Watch for vendor updates. Plugins, themes, hosting panels and devices that bundle their own copy of PHP will need separate updates over the coming weeks.

Sources: BBC News, The Guardian, CERT-EU advisory.

Not sure where to start?

Most business owners have no idea what their website runs on, let alone which version. That is normal, and it is exactly the gap attackers are counting on this week.

Contact TrueBlueIT for help if you are not sure what to do. We can check which of your systems are exposed, apply the patch, confirm nothing has been tampered with, and keep an eye on vendor updates so you can get back to running your business.

Where to next. Planning something similar? See web design and app development in Darwin, or read about the websites we have built. When you are ready, send a project brief and we will reply within one business day.

✦ End of piece