Emergency PHP security fixes released on Oct. 21 set off precautionary website shutdowns across several countries, with the Dutch National Cyber Security Centre (NCSC), parts of the Dutch parliament and Finnish government web infrastructure, France’s data protection authority CNIL, and Japanese services including pixiv and Niconico all going offline or entering maintenance.
The trigger was the release of patches for CVE-2026-109618 and CVE-2026-109619, two critical flaws rated 9.2 under CVSS v4.0 and collectively referred to in the security community as "php2shell." Both are unauthenticated remote code execution bugs, meaning an attacker can make a server run arbitrary code without logging in and without any action from a victim.
A 71-day path to a rushed release
The impact came from both the bugs and the way they were handled. From discovery to fix, the process took about 71 days. The original release date was Oct. 22, but the final 24 hours were compressed after information leaked.
At about 15:00 UTC on Oct. 20, the two CVE identifiers began circulating on forums and social media, along with an incorrect release time and an incorrect CVSS 10.0 score. The actual score was 9.2, and no technical details had been disclosed at that point. Around 20:00 UTC, Calif accidentally published a video showing exploit code running against multiple targets. Copies spread on social media. The PHP Foundation said the video helped others speed up development of their own attack tooling.
At 19:30 UTC, the PHP team issued an advisory and moved the release forward to 14:00 UTC on Oct. 21. The notice said: "The PHP security team is providing advance notice of a security update to be released on Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are advised to prepare to update. If details become public or there is evidence of active exploitation, the release will be moved forward."
That night, watchTowr confirmed the flaws were real. CEO Benjamin Harris said: "Given the sensitivity, we can’t share technical information at this time, but we can confirm these vulnerabilities do exist." A post also appeared on Hacker News and was later deleted. The author wrote that they had no evidence beyond "source: trust me, bro," yet still correctly named the two flaws, the two CVE IDs, and the disclosure date, while listing the score as 10.0.
What had been a two-day buffer was reduced to a single night.
Memory handling bugs with broad exposure
Wiz said at least one of the flaws existed in every PHP version starting from PHP 5.4. The first signs, however, appeared while handling issues raised in a 2024 audit.
That audit was funded by the Sovereign Tech Agency, organized by OSTIF, and carried out by Quarkslab over about two months. It found 27 issues in total, including 17 security issues: 3 high severity, 5 medium, and 9 low. It also produced 4 CVE identifiers. The report explicitly said that, because of budget limits, the review focused on the most critical components rather than the full codebase.
The PHP Foundation later said the earliest sign of the OOM-related issue was found by a funded core developer while working on a fix for one of the problems listed in the Quarkslab audit report. In 2024, the team explored the issue’s exploitability in theory but did not find a concrete attack path, and the matter was later overshadowed by other, clearer issues.
CVE-2026-109618 happens when a request exactly exhausts PHP’s configured memory limit. Processing is interrupted, leaving internal data structures only partially initialized, and those structures are later treated as valid, causing memory corruption. CVE-2026-109619 is caused by a fatal error occurring at the wrong moment, leaving PHP’s internal state pointing to memory freed by a previous request. When the same worker process handles later requests, it reuses that memory, creating a use-after-free condition.
All PHP installations that process web requests are affected, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed deployments. The highest risk is tied to mod_php. In that setup, an unauthenticated request can trigger the flaw before any application code runs, and full remote code execution has already been demonstrated under default settings. An attacker could use that access to read passwords, login tokens, API keys, and certificates from server process memory.
AI-assisted discovery, then months of stalled fixes
On Aug. 11, 2026, Calif researcher Ryan Austin reported the first unconditional remote code execution case tied to the same root cause as the OOM issue identified in 2024. OpenAI independently reported the same root cause that day. Wiz submitted a separate report on Aug. 24, and OpenAI reported additional trigger paths on Sept. 18.
A Calif researcher used OpenAI’s GPT-5.6 Sol model to assist the audit work that led to the discovery. Calif CEO Thai Duong called PHP Foundation security engineer Volker Dusch on Aug. 11 to warn him. OpenAI said that, to its knowledge, this was the first time frontier AI had identified a vulnerability of this kind before attackers did, opening what it called a "defender window." Wiz co-founder Ami Luttwak described it as "the most severe vulnerability ever found by AI" and said it would have been very difficult to uncover without AI.
The repair effort then stalled and restarted repeatedly over several months. The PHP Foundation said publicly: "We won’t pretend otherwise: this delay was a structural failure, caused both by the security team’s decision-making process and by a lack of resources." The team operated by consensus, and the work "stalled and restarted repeatedly over several months."
Several competing fixes were designed, each with trade-offs. Some would break backward compatibility. Some could introduce new denial-of-service risk. Others would require extensive changes across third-party extensions and seemed impossible to coordinate. The team said it was "afraid of the consequences of choosing the wrong direction." The final patch touched nearly 200 files and more than 10,000 lines of code, led by PHP maintainers and completed under embargo over about two months.
Among the corrective steps proposed by the PHP Foundation was a shift from consensus-based security decisions to majority voting, along with an explicit push for compromise inside the team.
Early images, early WAF rules, and live attack traffic
At 07:41 UTC on Oct. 21, software supply chain company Chainguard published container images containing the fixes more than six hours before the coordinated disclosure time. The PHP Foundation said that move "disregarded weeks of work by many parties."
The official PHP patches went live at about 13:35 UTC, a few minutes ahead of the planned 14:00 release. Cloudflare’s web application firewall rules had already been enabled by default for both free and paid users at 03:02 UTC, roughly nine hours before the official disclosure. Cloudflare said the rules use both request-side and response-side signals to block exploit attempts and prevent data exfiltration.
Cloudflare CTO Dane Knecht said: "We are seeing early attacks and updating mitigations as new techniques emerge. This is only a stopgap."
Governments and agencies tell operators to patch or disconnect
As the disclosure approached, public-facing systems were taken offline as a precaution. The Dutch NCSC site was shut down preventively. Parts of Dutch and Finnish government web infrastructure went offline. CNIL closed its site. In Japan, BASE, pixiv, and Niconico entered emergency maintenance.
France’s Interior Ministry said local government websites were temporarily taken offline as a precaution, and hospitals were also affected. Dutch e-commerce association Thuiswinkel.org temporarily shut down some of its own sites and told members to contact their technical providers that day, adding that the issue was not limited to WordPress or WooCommerce and that any system version needed to be updated. Japanese Prime Minister Sanae Takaichi also posted on X that evening, urging organizations to inspect systems and prepare patches.
CERT-EU issued advisory 2026-018 on Oct. 20 and said organizations unable to patch should "consider isolating internet-facing applications from public networks." The UK’s National Cyber Security Centre said organizations that could not immediately remediate should consider taking systems offline until full mitigation was in place. The US Cybersecurity and Infrastructure Security Agency issued an alert on Oct. 21 recommending PHP upgrades and said systems on 8.1 and earlier that could not be upgraded should be taken offline. Similar guidance came from Australia’s ACSC, Japan’s IPA, and France’s CERT-FR.
The US National Security Agency wrote on social media: "These vulnerabilities often provide a direct path to the server file system or database."
More than 70% of exposed systems with known versions run unsupported branches
PHP made an exception by releasing minimal source patches for end-of-life PHP 7.4, 8.0, and 8.1. Linux distributions and long-term support vendors received patches in advance. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Older versions, however, must rely on distributors or be taken offline. Under VirusTotal’s view of servers with disclosed version information, about 758,000 systems were running PHP 5.4 through 8.1, which no longer receive official upstream patches, while about 272,000 were on supported branches. CyberScoop, citing researchers, said more than 1.3 million internet-exposed hosts may be affected. Shodan counted about 1.9 million. Among the 1.03 million exposed PHP servers with disclosed version information, 73.6% were running PHP 5.4 through 8.1.
Cisco Talos estimated from open-source intelligence that about 50% of PHP systems will not receive patches. Security support for the PHP 8.2 branch ends on Dec. 31, 2026. That leaves organizations still on 8.2 with roughly a two-month buffer before the next event of similar severity would hit an unsupported branch.
Official line: patching is the only safe option
According to W3Techs, PHP powers about 70% of websites using known server-side languages. WordPress accounts for about 43% of all websites globally. Wordfence warned that every WordPress site runs on a PHP server, but WordPress auto-updates do not patch the PHP layer itself.
One confirmed attack path involves PHP’s session upload progress feature, session.upload_progress, which has been enabled by default for more than a decade even though few sites actually use it. Suggested mitigations include disabling that feature and lowering post_max_size, but PHP said plainly that "there is no complete mitigation; upgrading is the only safe choice."
PHP core developer Gina Peter Banyard said: "The only mitigation is to patch or upgrade PHP." Responding to suggestions that disabling session upload progress would be enough, PHP 8.6 release manager Joe Ferguson said: "ini settings won’t save you."
As of Oct. 21, there were no confirmed victims, no confirmed data exposure totals, and no confirmed financial losses in public reporting. The known facts were precautionary shutdowns and Cloudflare’s observation of attack traffic.
Sansec said: "We expect mass attacks to begin within 15 minutes of release." watchTowr head of threat intelligence Jake Knott said: "While nobody has succeeded yet, we do not think that will last long." Calif CEO Thai Duong said: "Anyone on Twitter can take the patch, run AI on it, and post an exploit script. Then all hell breaks loose."
Volker Dusch, a security engineer at the PHP Foundation, compared the event to Heartbleed in 2014 and called it the most serious PHP security issue in more than a decade. On the decision to release early, he said the team had struck a "good balance" between warning defenders and not giving attackers too much development time.
Independent security consultant and visiting senior research fellow at King’s College London Lukasz Olejnik said: "Everyone should patch immediately. Attacks may come very fast and at very large scale. AI makes exploitation of this kind of vulnerability urgent. Really, this is a matter of one or two minutes." Dutch ethical hacker Wouter van Dongen added: "A patch closes the hole, but it cannot undo prior compromise ... many systems will remain vulnerable for a long time because not everyone will update immediately, and older PHP versions no longer receive official security updates."