PHP2Shell Is Being Exploited Before Patches, and Websites Are Going Dark

Websites in several countries went dark this week while operators raced to patch PHP2Shell, a pair of unauthenticated flaws in the PHP engine that attackers were probing before any fix existed. Amazon's threat intelligence team said it detected an attempt to exploit the flaws on October 17, four days before PHP shipped emergency releases on October 21, according to The Register.

The flaws, CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 under CVSS v4.0. Because they live inside PHP itself, they reach well beyond any single application. CNN reported that the U.S. National Security Agency and Europe's cybersecurity agency urged companies to take immediate action, and it said PHP powers about 70 percent of the world's websites.

PHP2Shell attacks began days before the patch

PHP's security team had scheduled an out-of-band release for October 21 and withheld technical details while it coordinated disclosure. Those details leaked, and Recorded Future reports that disclosure moved up. One account says the original plan was October 22, so the exact schedule is still disputed.

Attack activity appears to have started well before the release. Cloudflare reported early attempts against PHP sites at 07:43 UTC on October 21, hours before the patches arrived, and it is not yet clear how many of those attempts worked. watchTowr says it has observed in-the-wild exploitation of both CVEs but has published no evidence or indicators of compromise, so defenders cannot yet check its findings against their own logs.

Hadrian, a security firm, described the flaws as "exploited in the wild at scale." Most of the abuse it saw targeted PHP's session upload-progress path. Cloudflare also reported attackers adjusting their payloads to get past its web application firewall, which suggests they are testing defenses in real time rather than only probing for open doors.

The embargo leak made the window worse. Many security teams said the leak made attacks more likely before a patch could be deployed. AI Weekly reports that Sansec warned mass exploitation would follow within minutes of a public fix, which is why patching speed matters more than usual this time.

Which PHP versions are fixed

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. AlmaLinux has published patched packages for its distribution, and TuxCare's patch guide walks through the version picture in detail.

Older branches are the hard case. Some distributions ship source-level backports, but PHP 8.1 and older get no standard release. A count by Mallory, cited in TuxCare's guide, put roughly 884,000 internet-facing hosts on branches upstream no longer patches. Security researcher Silas Cutler estimated up to 1.3 million hosts at risk, according to How-To Geek.

How many sites went offline, and how many were hacked

Shutdowns hit government sites in several countries. The reported list includes Dutch, French, German, Belgian and Finnish government sites, along with Wikimedia systems. A TechRadar live blog said the UK government reported 32 government services offline.

Those figures describe outages, not breaches. Several sources stress that a shutdown does not prove a successful hack, and WorthvieW notes that many sites went dark to patch or prepare. The exact list of affected sites and their restoration status has not been confirmed.

For US readers, the exposure is broad. Any business, university or government site running an affected branch on a web server is at risk. Sites built on WordPress, Drupal or Joomla are especially exposed because those platforms run on PHP, and site owners often do not control which PHP version their host runs.

Does patching fully close the hole

Not everyone agrees. Abstract Security says it reproduced unauthenticated code execution on a fully patched PHP 8.2.35 host. Its analysis argues the fix addresses a stale-state bug but not the upload-progress producer, while other vendors describe the patch as the complete fix.

Until that conflict is resolved, treat the patch as necessary but possibly not sufficient. Exploitation running ahead of fixes is a recurring pattern, and USA 24 has covered it in the Arista VeloCloud zero-day and in Fortinet's emergency FortiOS patches.

How to check your sites and patch them now

1. Find every PHP version you run. On a server, open a shell and run php -v. On shared or managed hosting, check the control panel or ask support.
2. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution's vendor backport.
3. Restart PHP workers after patching, such as PHP-FPM or your web server's PHP process, so the old code is no longer loaded.
4. If a host runs PHP 8.1 or older, get a vendor backport, upgrade, or isolate the site until you can.
5. Ask your hosting provider whether the fix is applied, since many shared hosts patch on their own schedules.
6. Review logs for suspicious file uploads and unusual session activity since October 17.

Do not assume a shutdown means you are clean, and do not assume a patch means you are safe.

What to watch next

Three open questions will shape the coming days. First, one tracker's write-up says PHP2Shell was not yet listed in CISA's Known Exploited Vulnerabilities catalog, as of its latest update. A KEV listing would trigger US federal patch deadlines, so that decision is worth watching closely. Shattered covered the catalog's latest additions.

Second, watch whether watchTowr or another research team publishes indicators of compromise that let site owners check their logs directly. Third, the discovery story is still forming. The flaws are credited to teams at OpenAI, Wiz and another firm, and CNN describes the exploit work as AI-assisted. Wiz's technical post is the best place to follow that thread.

Exploitation tends to outlast patches. A Citrix NetScaler zero-day is still planting web shells on US VPN gateways, a reminder that attackers keep returning to flaws long after fixes ship. The next few days will show whether PHP's patch closes the door or only narrows it. For most site owners, the job is to update to a fixed branch, restart PHP, and check logs back to October 17 before declaring a site clean.