PHP2Shell: How Hackers Targeted Critical PHP Flaws Days Before Emergency Patches

Internet works so seamlessly most days that we rarely think about the invisible engine executing code behind our screens. You click a link, submit a form, or check a bank balance, and the page renders in milliseconds. But on Wednesday, October 21, 2026, thousands of web users encountered something unusual: government portals in the Netherlands, Finland, and France abruptly showed maintenance screens, European banks warned customers of investigations, and developer tools like Wikimedia’s Phabricator went offline without warning.

The cause of this sudden blackout was a coordinated emergency in the web’s core plumbing: two critical vulnerabilities in PHP, collectively nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Ranked with a maximum severity CVSS score of 9.2 by PHP maintainers (and a full 10.0 by third-party security teams), these bugs allow unauthenticated attackers to execute arbitrary code remotely on affected servers.

src="https://thumb.wikimedia.org/wikipedia/commons/thumb/3/32/Wikimedia_Phabricator_PHP2Shell.png/1200px-Wikimedia_Phabricator_PHP2Shell.png" alt="Wikimedia Phabricator maintenance screen during PHP2Shell incident" class="w-full h-auto rounded-2xl shadow-lg border border-black/10 dark:border-white/10 object-contain max-h-[550px] mx-auto block" /Wikimedia’s Phabricator developer platform taken offline as a precaution while emergency patches were prepared.

Who found the flaw vs. who saw the attacks

In the initial flurry of reporting, confusion spread about who discovered the bugs. The flaws were not discovered by Amazon Web Services. Instead, they were independently identified in August 2026 by two distinct research teams leveraging artificial intelligence: Ryan Austin at security firm Calif (as part of OpenAI’s "Patch the Planet" initiative using GPT-5.6 Sol) and researchers at cloud security firm Wiz (using Gemini 4 Argon, GPT-5.6 Sol, and their proprietary Wiz Atlas engine).

Remarkably, the underlying out-of-memory error was actually identified by a PHP core developer as far back as 2024 during a routine audit. However, because no weaponized exploit was known at the time and the development team could not reach consensus on a fix, the issue was left unpatched for nearly two years.

Where AWS enters the timeline is far more alarming. Through telemetry gathered on its distributed MadPot honeypot network, Amazon Threat Intelligence detected live exploitation attempts beginning on October 17—four full days before the coordinated public embargo lifted on October 21. Attackers routing payloads through commercial VPN and proxy networks had already obtained working exploit mechanics while the rest of the internet was kept in the dark.

The true scale: why shutting down became the safest option

To understand why national agencies took websites offline, look at the ecosystem numbers. According to survey data from W3Techs, PHP powers 69.3% of all websites whose server-side programming language can be identified. WordPress alone—which runs on PHP—drives approximately 39.6% of all websites globally, alongside systems like Drupal, Joomla, cPanel, and Plesk.

Because the vulnerability resides in core PHP runtime memory management rather than individual CMS plugins, any publicly accessible PHP endpoint handling user-supplied requests was potentially susceptible to takeover. Facing this risk, cybersecurity bodies like the UK National Cyber Security Centre (NCSC) and the US National Security Agency (NSA) advised a drastic temporary measure: if you cannot patch immediately or apply strict WAF filtering, pull the server offline.

That guidance led to immediate shutdowns across Europe:

• Overheid.nl: The official portal of the Dutch government and its personal login area were taken offline with 503 maintenance errors.
• French Interior Ministry: Public web properties were temporarily isolated from incoming traffic.
• Finnish and Danish Public Services: Government portals and national school communication platforms were suspended.
• bunq: The Dutch neobank proactively notified users that funds were safe while its engineering team inspected internal infrastructure.
• Community platforms: The Internet Archive, 4chan, and Something Awful briefly halted access to prevent compromise.

The technical flaw: how a memory error becomes a root shell

At a technical level, the vulnerabilities affect PHP versions 5.4 through 8.5—representing more than twelve years of PHP releases. The bug occurs when PHP processes memory allocation during a heavy or malformed web request. When an out-of-memory exception is triggered in certain core parser routines, the engine fails to clean up internal execution pointers properly.

By carefully crafting the request headers and payload size, an attacker can manipulate unallocated heap memory to overwrite execution pointers, hijacking control flow and executing arbitrary code with the permissions of the web server process (such as www-data or nobody). Once inside, attackers can read database credentials, deploy persistent web shells, or pivot laterally into cloud networks.

What administrators and developers must do now

The PHP Foundation has released official security updates for all active branches. If you maintain PHP infrastructure, the immediate checklist is clear:

• Verify running versions: Execute php -v and check your FPM or Apache modules. Patched versions are 8.2.25, 8.3.13, 8.4.1, and 8.5.0-dev fixes.
• Update distribution packages: Pull the latest updates from Debian, Ubuntu, AlmaLinux, or your hosting control panel (cPanel, Plesk, CloudLinux).
• Deploy WAF mitigation: If immediate runtime updates are impossible, enable managed Web Application Firewall rules (such as Cloudflare’s emergency PHP2Shell signature) to block abnormal header payloads.
• Inspect access logs: Search web logs for requests around October 17–21 containing excessive header lengths or requests to dormant endpoints coming from proxy and Tor exit nodes.

The biggest hurdle moving forward is the vast tail of neglected infrastructure. Millions of production websites still run on end-of-life PHP 7.4 or 8.0 installations that no longer receive upstream security releases. For those legacy servers, survival depends on host-level protections, container isolation, and migrating off deprecated runtimes before automated scanning worms sweep the remaining surface.