# PHP2Shell Is Being Exploited Before Patches, and Websites Are Going Dark

- URL: https://usa-24.com/php2shell-exploitation-patch-guide/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-23T10:25:38.009Z
- Updated: 2026-10-23T10:25:38.015Z
- Topics: PHP2Shell, PHP Security, Web Vulnerabilities, Zero-Day Exploits, WordPress Security

> Attacks on PHP2Shell began days before PHP's emergency fixes shipped, and government sites in several countries went offline. Here are the fixed versions and the checks to run now.

## Key takeaways

- Amazon's threat intelligence team says it detected an exploit attempt against the flaws on October 17, four days before PHP's October 21 patches.
- The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP 8.1 and older get no standard upstream release.
- Cloudflare reported early attack attempts against PHP sites at 07:43 UTC on October 21, and how many of them succeeded is still unclear.
- Abstract Security says it reproduced unauthenticated code execution on a fully patched PHP 8.2.35 host, a claim that conflicts with other vendors calling the patch complete.
- As of one tracker's write-up, PHP2Shell was not yet listed in CISA's Known Exploited Vulnerabilities catalog.

Websites in several countries went dark this week while operators raced to patch PHP2Shell, a pair of unauthenticated flaws in the PHP engine that attackers were probing before any fix existed. Amazon's threat intelligence team said it detected an attempt to exploit the flaws on October 17, four days before PHP shipped emergency releases on October 21, according to [The Register](https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749).

The flaws, CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 under CVSS v4.0. Because they live inside PHP itself, they reach well beyond any single application. CNN reported that the U.S. National Security Agency and Europe's cybersecurity agency urged companies to take immediate action, and it said PHP powers about 70 percent of the world's websites.

## PHP2Shell attacks began days before the patch

PHP's security team had scheduled an out-of-band release for October 21 and withheld technical details while it coordinated disclosure. Those details leaked, and [Recorded Future](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation) reports that disclosure moved up. One account says the original plan was October 22, so the exact schedule is still disputed.

Attack activity appears to have started well before the release. Cloudflare reported early attempts against PHP sites at 07:43 UTC on October 21, hours before the patches arrived, and it is not yet clear how many of those attempts worked. [watchTowr](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/) says it has observed in-the-wild exploitation of both CVEs but has published no evidence or indicators of compromise, so defenders cannot yet check its findings against their own logs.

Hadrian, a security firm, described the flaws as "exploited in the wild at scale." Most of the abuse it saw targeted PHP's session upload-progress path. Cloudflare also reported attackers adjusting their payloads to get past its web application firewall, which suggests they are testing defenses in real time rather than only probing for open doors.

The embargo leak made the window worse. Many security teams said the leak made attacks more likely before a patch could be deployed. [AI Weekly](https://aiweekly.co/ai-news-today) reports that Sansec warned mass exploitation would follow within minutes of a public fix, which is why patching speed matters more than usual this time.

## Which PHP versions are fixed

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. [AlmaLinux](https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/) has published patched packages for its distribution, and [TuxCare's patch guide](https://tuxcare.com/blog/php2shell-cve/) walks through the version picture in detail.

| PHP branch | Fixed release | Status |
|---|---|---|
| 8.5 | 8.5.12 | Upstream fix released October 21 |
| 8.4 | 8.4.27 | Upstream fix released October 21 |
| 8.3 | 8.3.36 | Upstream fix released October 21 |
| 8.2 | 8.2.35 | Upstream fix released October 21 |
| 8.1 and older | None upstream | Vendor backports or upgrade only |

Older branches are the hard case. Some distributions ship source-level backports, but PHP 8.1 and older get no standard release. A count by Mallory, cited in TuxCare's guide, put roughly 884,000 internet-facing hosts on branches upstream no longer patches. Security researcher Silas Cutler estimated up to 1.3 million hosts at risk, according to [How-To Geek](https://www.howtogeek.com/your-favorite-websites-are-down-due-to-an-internet-breaking-security-failure/).

## How many sites went offline, and how many were hacked

Shutdowns hit government sites in several countries. The reported list includes Dutch, French, German, Belgian and Finnish government sites, along with Wikimedia systems. A [TechRadar live blog](https://techradar.com/pro/live/php-issues-affect-websites-across-the-world-all-the-latest-updates-and-what-you-need-to-know) said the UK government reported 32 government services offline.

Those figures describe outages, not breaches. Several sources stress that a shutdown does not prove a successful hack, and [WorthvieW](https://www.worthview.com/php2shell-crisis-which-major-websites-went-offline-and-why/) notes that many sites went dark to patch or prepare. The exact list of affected sites and their restoration status has not been confirmed.

For US readers, the exposure is broad. Any business, university or government site running an affected branch on a web server is at risk. Sites built on WordPress, Drupal or Joomla are especially exposed because those platforms run on PHP, and site owners often do not control which PHP version their host runs.

## Does patching fully close the hole

Not everyone agrees. [Abstract Security](https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619) says it reproduced unauthenticated code execution on a fully patched PHP 8.2.35 host. Its analysis argues the fix addresses a stale-state bug but not the upload-progress producer, while other vendors describe the patch as the complete fix.

Until that conflict is resolved, treat the patch as necessary but possibly not sufficient. Exploitation running ahead of fixes is a recurring pattern, and USA 24 has covered it in [the Arista VeloCloud zero-day](https://usa-24.com/arista-velocloud-zero-day-exploited/) and in [Fortinet's emergency FortiOS patches](https://usa-24.com/fortinet-emergency-patch-fortios/).

## How to check your sites and patch them now

1. Find every PHP version you run. On a server, open a shell and run `php -v`. On shared or managed hosting, check the control panel or ask support.
2. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution's vendor backport.
3. Restart PHP workers after patching, such as PHP-FPM or your web server's PHP process, so the old code is no longer loaded.
4. If a host runs PHP 8.1 or older, get a vendor backport, upgrade, or isolate the site until you can.
5. Ask your hosting provider whether the fix is applied, since many shared hosts patch on their own schedules.
6. Review logs for suspicious file uploads and unusual session activity since October 17.

Do not assume a shutdown means you are clean, and do not assume a patch means you are safe.

## What to watch next

Three open questions will shape the coming days. First, one tracker's write-up says PHP2Shell was not yet listed in CISA's Known Exploited Vulnerabilities catalog, as of its latest update. A KEV listing would trigger US federal patch deadlines, so that decision is worth watching closely. [Shattered](https://shattered.io/cisa-kev-palo-alto-cisco-ahsay-four-flaws-october-2026/) covered the catalog's latest additions.

Second, watch whether watchTowr or another research team publishes indicators of compromise that let site owners check their logs directly. Third, the discovery story is still forming. The flaws are credited to teams at OpenAI, Wiz and another firm, and CNN describes the exploit work as AI-assisted. [Wiz's technical post](https://www.wiz.io/blog/php2shell-php-rce) is the best place to follow that thread.

Exploitation tends to outlast patches. A [Citrix NetScaler zero-day](https://usa-24.com/cve-2026-88771-netscaler-zero-day-exploit/) is still planting web shells on US VPN gateways, a reminder that attackers keep returning to flaws long after fixes ship. The next few days will show whether PHP's patch closes the door or only narrows it. For most site owners, the job is to update to a fixed branch, restart PHP, and check logs back to October 17 before declaring a site clean.

## Frequently asked questions

### Is my website affected by PHP2Shell?

Sites running PHP 8.5 before 8.5.12, PHP 8.4 before 8.4.27, PHP 8.3 before 8.3.36, PHP 8.2 before 8.2.35, or any branch older than 8.2 are at risk. Check your version with php -v on a server or in your hosting control panel. Sites on WordPress, Drupal or Joomla are especially exposed because those platforms run on PHP.

### What are the PHP2Shell CVE numbers?

The two flaws are CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSS v4.0. They are unauthenticated flaws in the PHP engine, so they can affect sites that have nothing to do with PHP's own code.

### Did PHP2Shell take websites down?

Several government sites in the Netherlands, France, Germany, Belgium and Finland went offline, along with Wikimedia systems. TechRadar's live blog reported that the UK government had 32 services offline. Multiple sources say those shutdowns do not prove a successful hack.

### Does updating PHP fully protect my site?

Most vendors describe the October 21 releases as the complete fix. Abstract Security says it reproduced code execution on a fully patched PHP 8.2.35 host, so the question is not fully settled. Update to a fixed release, restart PHP, and review logs from October 17 onward.

## Sources

1. [Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet — CNN](https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl)
2. [Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure — The Register](https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749)
3. [PHP2Shell Exploitation: Two Critical PHP Flaws Explained — Recorded Future](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation)
4. [php2shell (CVE-2026-109618, CVE-2026-109619): Patched PHP packages released — AlmaLinux](https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/)
5. [PHP2Shell RCE Exploited: CVE-2026-109618 & CVE-2026-109619 — watchTowr](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/)
6. [Your favorite websites are down due to an internet-breaking PHP security flaw — How-To Geek](https://www.howtogeek.com/your-favorite-websites-are-down-due-to-an-internet-breaking-security-failure/)
7. [PHP security crisis — what you need to know as issues affected websites across the world — TechRadar](https://techradar.com/pro/live/php-issues-affect-websites-across-the-world-all-the-latest-updates-and-what-you-need-to-know)
8. [PHP2Shell: Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 — Abstract Security](https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619)
9. [php2shell CVE-2026-109618 and CVE-2026-109619 PHP RCE Patch Guide — TuxCare](https://tuxcare.com/blog/php2shell-cve/)
10. [PHP2Shell Crisis: Which Major Websites Went Offline, and Why — WorthvieW](https://www.worthview.com/php2shell-crisis-which-major-websites-went-offline-and-why/)
11. [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet — Wiz](https://www.wiz.io/blog/php2shell-php-rce)
12. [AI News Today, October 23: Top Stories — AI Weekly](https://aiweekly.co/ai-news-today)