Government portals, hospitals, universities and even Wikipedia have taken websites offline after the discovery of PHP2Shell, a pair of critical security flaws in PHP, the programming language behind a huge share of the internet. Details leaked before a fix was ready, setting off a global scramble to protect servers. Here is what PHP2Shell is, who has been affected and what website owners need to do.
What is PHP2Shell
PHP2Shell is the name given to two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, in PHP itself rather than in any single app. They can let an attacker run their own code on a web server without logging in. PHP’s developers rated them 9.2 out of 10 for severity.
Why it is so serious
PHP is used by around 70% of websites whose server-side language is known, including sites built on WordPress, Drupal and Joomla. The flaws are believed to affect versions dating back to PHP 5.4, and every PHP installation that serves web pages is considered exposed.
Found with help from AI
The flaws were disclosed jointly by researchers from Calif, Wiz and OpenAI. They had been hidden in PHP’s code for more than a decade. Wiz researchers said frontier AI models greatly lowered the barrier to proving the bugs could be exploited, turning a long-standing flaw into a working attack.
A leak before the fix
The PHP team had planned to release patches on October 21, but details leaked online first. Calif also accidentally posted a proof-of-concept video before taking it down. Proof-of-concept code soon appeared on GitHub, putting pressure on website owners to act before attackers could.
Europe’s websites go dark
Many organizations chose to shut sites down rather than risk an attack. In the Netherlands, the government portal Overheid.nl, the Port of Rotterdam and the KNVB football association went offline. Finland’s state IT provider Valtori took government services offline, and French prefectures, Danish services and Austrian universities were also affected.
Disruption worldwide
The impact spread well beyond Europe. Canada took some government websites offline as a precaution, and Australia reported an outage affecting several government sites, including its national cyber security website. Wikipedia, the Internet Archive and 4chan also took some systems offline while they applied fixes.
Attacks already spotted
Amazon Threat Intelligence said it detected a PHP2Shell exploitation attempt on its decoy network on October 17, days before public disclosure. Security firm watchTowr has also reported attacks in the wild. However, the full extent of successful break-ins remains unclear, and few confirmed compromises have been reported so far.
What to do now
The PHP team has released fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and says updating is the only complete fix. Experts also advise restarting every service that runs PHP. Ordinary users do not need to patch their devices but may see some websites in maintenance mode.
