PHP2Shell: What Happened, and What It Means for Your Vendors

On October 21, the PHP project shipped emergency fixes for two flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The flaws can allow unauthenticated remote code execution. The bugs are in PHP itself, not in an application or plugin, so well-written application code doesn’t protect you. CISA says they affect all PHP installations serving web requests and urges organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 right away.

How PHP2Shell Was Found and Fixed

Researchers at Calif, OpenAI, and Wiz found the flaws in August and reported them to the PHP security team. Wiz says AI models helped it find the bugs, build working exploits, and check the patch. Disclosure was planned for October 22. On October 20, the CVE IDs began circulating online, and Calif mistakenly published a video of a working proof of concept. PHP moved its release up a day and shipped fixes on October 21, along with minimal backports for PHP 7.4, 8.0, and 8.1.

What Cloud and Security Vendors Did

Several vendors shipped protections on or before patch day. Cloudflare turned on WAF rules for PHP2Shell by default on October 21, including for customers on its free plan, and says it saw attackers change their payloads to get around those rules. AWS published WAF rules customers can deploy while they patch. Google Cloud said its own infrastructure isn’t affected, began rolling out patched PHP base images for App Engine and Cloud Run, and said customers with active Cloud Armor managed rules were already covered. Wiz added detections and a runtime policy that stops processes showing signs of PHP2Shell exploitation. cPanel, Plesk, Debian, Red Hat, and Ubuntu shipped fixed PHP packages.

Why Websites Went Offline

Organizations in several countries took websites offline on October 21 as a precaution until they could patch. In the Netherlands, the national cyber agency NCSC-NL took its own website offline, and others followed, including the House of Representatives and the Dutch Data Protection Authority. Finland’s state IT provider Valtori took central government web services offline and said this was a precaution, not a response to a breach. The University of Vienna switched off its websites, webmail, and Moodle, and the University of Freiburg took services down. In Japan, Prime Minister Sanae Takaichi warned of the flaws on X. She urged users to be ready to install the fix as soon as it came out and said temporarily suspending website functions could reduce risk if they couldn’t patch right away. The Japan Times reported that bank, business, and ministry websites in Japan were halted after the flaws were announced.

CISA advised organizations that can’t update right away, or that still run PHP 8.1 or earlier, to take PHP-based systems offline until they’re patched. The UK’s NCSC told teams to update first, apply temporary mitigations if they couldn’t, and consider taking systems offline only if neither was possible in time. CERT-EU suggested considering isolating internet-facing systems that couldn’t be patched.

Is PHP2Shell Being Exploited?

Attackers are trying, but no successful compromise has been publicly confirmed. Amazon’s threat intelligence team says it first saw an exploitation attempt before public disclosure. Amazon says PHP2Shell is now seeing broad exploitation attempts in the wild, but that it’s unclear whether any would have succeeded against real systems. watchTowr and Cloudflare reported attempts around patch day. Rapid7 found that each public exploit works only on a specific mix of operating system, PHP version, and web server. In its alert, last revised October 23, CISA says it has not observed successful exploitation in the wild.

The PHP You Don’t Run Yourself

Patching your own servers is the clear part. CISA’s first recommendation is to inventory every system running PHP. It notes that PHP “is often a component of other software and prevalence may not be directly observable.” Software that bundles PHP includes hosting control panels, network appliances, and SaaS products. Your exposure includes every vendor whose stack runs PHP, and you can’t patch theirs.

What to Ask Your Vendors About PHP2Shell

Start with the vendors that hold your data, connect to your network, or support critical services. For lower-risk vendors, the first question may be enough. If a vendor doesn’t run PHP, a one-line confirmation is fine.

1. Do you run PHP anywhere that serves web requests in the services you provide to us, including inside control panels, appliances, or licensed software? Which versions?
2. Do any of your providers or subprocessors that handle our data run PHP?
3. Have you applied the fixed releases and restarted PHP services, and when?
4. If you haven’t patched yet, including anything on PHP 8.1 or earlier, what’s in place until you do, and when will you?
5. Are you monitoring for PHP worker processes launching shells or downloading tools?

Ask about compromise, and give a date. Amazon says it saw an exploitation attempt against its honeypots on October 17, four days before disclosure, and recommends investigating from at least that date. Ask vendors to review activity from October 17 onward and tell you whether anything affected your data or services. A clean result doesn’t confirm a system is safe: Rapid7 notes that missing logs don’t prove it, and the flaws can also leak process memory that may hold passwords, tokens, and API keys. For critical vendors, ask whether they’ve rotated credentials on systems that ran a vulnerable version.

Ask for evidence, not a yes. Linux distributions can ship fixes under old-looking version numbers, so a changelog entry naming the CVEs tells you more than a version string. Get a named contact, set a deadline based on the vendor’s risk, and ask them to tell you if they find anything.

The same questions are heading your way. Customers will ask whether you’re affected, and your answer needs to match what you actually did. SecurityPal helps teams on both sides of that exchange. Vendor Assess helps you manage vendor assessments with AI-assisted analysis and expert review, and Trust Center gives customers one controlled place to find your security documentation.

FAQs

1. What is PHP2Shell?
   It’s the name for CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP runtime that can allow unauthenticated remote code execution. PHP fixed them on October 21, 2026.
   ‍
2. Which PHP versions fix PHP2Shell?
   PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix these vulnerabilities. PHP 8.1 and older no longer receive updates from the PHP project, but its security team provided minimal source backports for 7.4, 8.0 and 8.1, and some Linux distributions and long-term support vendors offer backported fixes.
   ‍
3. Why did websites go offline?
   Government agencies and other organizations took sites offline as a precaution until they could patch. CISA advised this for systems that couldn’t be updated right away or that run PHP 8.1 or earlier.
   ‍
4. Is PHP2Shell being exploited?
   Amazon says PHP2Shell is seeing broad exploitation attempts in the wild, but it’s unclear whether any would have succeeded against real systems. As of October 23, CISA said it had not observed successful exploitation in the wild, and neither CVE was in its Known Exploited Vulnerabilities catalog.
   ‍
5. What should I ask vendors about PHP2Shell?
   Whether they run PHP on anything that serves web requests, which versions, whether their providers or subprocessors run PHP, whether they’ve patched and restarted PHP services, what’s in place until they do, and whether they’re monitoring for signs of exploitation.