PHP2Shell · CVE-2026-109618 + CVE-2026-109619 · fixed 21 Oct 2026

PHP broke. Everyone pulled the plug.

PHP runs about 7 in 10 websites. On Tuesday 20 October the numbers of two bugs that let a stranger take over a PHP server leaked, a day before the fix, and a video of the attack followed by mistake. Agencies said patch, or switch off. Japan's Prime Minister asked the country the same at 9:55 pm, and parliaments, ports, ministries, banks, universities and parts of Wikipedia went dark. The day, in order.

Fixed releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later.

Or have it done: Hongdam fixes PHP, a server ฿5,000

Each square: a server0 patched
23 hthe bug numbers leaked before the fix
4 daysfrom the first attempt Amazon caught, 17 Oct, to the fix
211Japanese organisations that announced shutdowns or checks by 1 am the next day
1.57 Minternet-facing hosts showing an unpatched PHP version (Censys, via SecurityWeek)
Wednesday

And then everyone took their system offline

Wednesday 21 October 2026, in order. Times are UTC; Bangkok is seven hours ahead.

  1. Tue 15:00

    It starts a day early. The two bug numbers turn up on forums and Hacker News, 23 hours before PHP is ready. Register

  2. Tue 17:00

    and one of the finders posts a video of the attack by mistake, deletes it, and the copies spread. Register

  3. 02:00

    and attack code is going round; Amazon's decoy servers catch attempts, and one from as early as Saturday 17 October, Amazon

  4. 07:41

    and a container company ships fixed PHP six hours before PHP does, which PHP says handed attackers the answer key. PHP Foundation

  5. 07:43

    and Cloudflare reports attacks too. Cloudflare

  6. 09:10

    and the Dutch cybersecurity agency takes its own website offline, NOS

  7. Wed

    and the Dutch parliament goes offline, NL Times

  8. Wed

    and the Port of Rotterdam goes offline, Reuters

  9. 11:00

    and the University of Vienna switches off its webmail, its Moodle and its cloud, "a purely precautionary measure", MeinBezirk

  10. Wed

    and Finland shuts its government web services, then finds no attempts on them, Reuters

  11. Wed

    and France's Interior Ministry switches off the prefecture sites, Reuters

  12. Wed

    and Germany's federal IT service takes federal sites down, and Belgium's foreign ministry does the same, Reuters

  13. 12:55

    and the Prime Minister of Japan, Sanae Takaichi, posts at 9:55 pm Tokyo time, 5:55 am in California: patch tonight, and if you can't, consider stopping your website. INTERNET Watch

  14. 14:00

    and PHP ships the fix. php.net

  15. 15:20

    and CERT-EU tells EU bodies to cut internet-facing systems off until the fix is in and checked, CERT-EU

  16. Wed

    and the NSA says take sites offline if they can't be updated, the UK's NCSC says consider it, and CISA says patch now, NBC · NCSC

  17. Wed pm

    and Denmark's school platform goes dark, with Copenhagen's city sites and the weather service, CPH Post

  18. Wed

    and parts of Wikipedia go down: the tools, the cloud and the bug tracker, until they can be patched, Wikimedia

  19. Wed

    and the Internet Archive goes down for emergency maintenance and security patches, Reuters

  20. Wed

    and Something Awful shuts its forums, and 4chan goes read-only, Mashable

  21. Wed

    and the BBC takes some portals down, and Orange suspends PHP services at several of its companies, Reuters

  22. 16:00

    and in Japan: Nomura, MUFG, ANA, JR East, the Ministry of Finance, the Meteorological Agency, the National Tax Agency, niconico and pixiv. By 1 am in Tokyo a public tally counts 211 organisations that announced shutdowns or checks, Reuters · INTERNET Watch

  23. 17:00

    and the Czech government's website goes offline on its cyber watchdog's advice. Reuters

  24. Wed

    Asana and GOG went down that day too, and people blamed PHP. Neither company said so. Mashable

All of it went dark by choice.By Thursday no one had published a confirmed break-in through the bug. One Japanese company, VALTEC, blamed PHP for its breach, then said hours later the hole was in its own service; it had been patching PHP at the same time. INTERNET Watch

And that's just PHP.

The same week, everywhere else:

  1. 21 Oct

    GitLab fixes a bug rated 10 out of 10, the top of the scale, that lets a stranger run code on the server. It is in every version since 7.0, from 2014: twelve years of self-hosted GitLab. GitLab

  2. 21 Oct

    LiteLLM, a popular library for calling AI models, ships version 1.107.0 with a password stealer inside, in every wheel and in the Docker image tagged latest. It runs every time Python starts after install; nobody has to import it. Second time this year. LiteLLM

  3. 21 Oct

    Railway, a hosting platform, pauses deployments in every region after someone reaches the systems that store customers' secrets, and asks everyone to change every secret stored there. Railway

  4. 21 Oct

    Node.js patches a bug that runs a stranger's code and three ways around its TLS checks, the checks that a server is who it says. Node.js

  5. 21 Oct

    State Bank of India, the country's biggest bank, files an "Incident involving Data Loss" with the stock exchanges: 3,897 customers' records found for sale. IFF

  6. 20 Oct

    CISA adds four Plex Media Server bugs to its list of bugs under attack. CISA

  7. 20 Oct

    SafePay ransomware: US, UK and German police count at least 600 victims across critical infrastructure. CISA

  8. 20 Oct

    Tor: a researcher shows 333 exit relays, about one in ten, steering SSH logins to servers built to catch passwords. kaba

  9. 19 Oct

    TiDB Cloud says someone walked around inside with stolen credentials from 9 September to 7 October. A group calling itself FulcrumSec claims 10.6 terabytes; the company has not confirmed it. PingCAP

  10. 17 Oct

    Zeabur, breached in August and again in October, announces it is shutting down. The whole company, by 31 December. Zeabur

  11. 9 Oct

    Japan: after breaches at more than 20 big companies, the ruling party's cybersecurity chief calls it "an emergency in cyberspace". The government issues an advisory; nobody declares a formal emergency. TNW

A private key should look like this
4eMudhra's looked like this

eMudhra is a certificate authority: its job is proving a website is who it says it is, and it says it has issued over 60 million certificates. Eight of its signing keys should each have been a random number about 116 digits long. All eight were under 256. One was 4; others were 66 and 237. Browsers stopped trusting them within three days, and about 30,000 customer certificates need replacing. Mozilla · Register

“Anyway, it's Wednesday.”

— @fiveoutofnine, who told the whole day in one breath at 23:12 UTC and was read 2.8 million times by Thursday. This page checks each line against its own source and corrects four: the Prime Minister posted at 9:55 pm Tokyo time, 5:55 am in California, and no source gives the 48.8 million; CISA said patch, not unplug; Asana and GOG were never tied to PHP; and Japan's "emergency" was a politician's phrase, not a declaration.

Meaning

A memory mix-up inside PHP hands a stranger the server

PHP reuses the same worker for request after request. Both bugs are about clean-up: when a request fails in an unusual way, PHP can leave behind scraps of memory it still trusts. A later request can pick them up. An attacker who arranges this can run their own commands on the server with the same rights as the website.

No password or account is needed, and the website's own code does not have to be faulty. A fully updated WordPress on an old PHP is still exposed.

CVE-2026-109618

Out-of-memory clean-up

9.2of 10, PHP's rating

PHP's title: RCE via OOM corruption. When a request runs out of memory, PHP can treat half-built data as valid while cleaning up.

CVE-2026-109619

Leftovers between requests

9.2of 10, PHP's rating

PHP's title: RCE via stale global state. Data from one request can outlive its memory and be used by the next request on the same worker.

RCE: remote code execution, running commands on someone else's computer. PHP scores both bugs 9.2 on CVSS v4, a 0-to-10 severity scale; NVD adds CVSS 3.1 scores of 9.8 for CVE-2026-109618 and 8.1 for CVE-2026-109619. The PHP Foundation says a 10.0 that circulated during the leak was wrong. PHP · NVD · PHP Foundation Sansec reports one path can also leak memory from other visitors' requests, such as passwords and session tokens.

The hole is in PHP, under the app

1The internetAnyone can send a request.
2Web servernginx, Apache, LiteSpeed pass it on.
3 · bug herePHP engineReads the request first. The patch fixes this layer.
4Your appWordPress, Magento, Laravel. Runs after.
Timeline

Fourteen years hidden, ten weeks to fix, attacks four days before the patch

The weakness was noticed more than once and left alone because nobody showed it could be used. In 2026 researchers working with AI models showed it could. Wiz credits frontier AI models with lowering the cost of turning the bug into an attack.

    Times in UTC; Bangkok is seven hours ahead. The PHP Foundation's own account sets the order of the first three events.

    News

    Day one: wide probing, few confirmed break-ins, and governments switched their own sites off

    Read to 23:00 UTC on 21 October, nine hours after the fix. Reports of attacks rose all day, but as of then no defender had published a confirmed break-in. The biggest measured effect was organisations taking themselves offline on official advice.

    2.6 Minternet-facing PHP hosts (VulnCheck); 57% show an unfixed version, 43% hide theirs
    245hosts showing a patched version on day one (OX Security, Shodan)
    211Japanese organisations that announced shutdowns or checks by 01:00 JST (piyolog tally)
    100+GitHub repos claiming an exploit by mid-afternoon; some suspected of carrying malware (Precursor)

    Attacks: who saw what, and when

    Claims of attack ran ahead of evidence

    Each dot is one public report, 20–21 October (UTC). Tap a dot or a row.

      The one intrusion attempt logged in detail, on VulnCheck's decoy servers at 17:22 UTC, tried to plant a web shell (a hidden control page) and failed. No vendor had published counts of blocked requests, compromised sites or attacker countries.

      Who switched off

      The NSA advised taking PHP sites offline if they could not be updated, the UK NCSC said to consider it, and CERT-EU said to isolate them; CISA said to patch now. Many went offline, most without having seen an attack.

      The patch race

      Most vendors had fixed packages within seven hours; several had none by evening

      Hours from PHP's release (14:00 UTC, 21 Oct) until each vendor had a fix out. Most times are when a roundup found the fix, so the fix may be older. Hatched: still waiting at the last check.

      Fixed byNot yet at last checkBefore the release

      End-of-life branches (7.4 to 8.1) rely on source patches, distribution backports and paid support vendors. The sury.org packages used by many Debian and Ubuntu servers carried backports all the way to PHP 5.6. Amazon Linux 2 lists its core PHP as "No Fix Planned".

      How it was found

      At least three teams found the bug independently in August 2026, each working with AI models. The PHP Foundation says one of its developers saw first signs of the same out-of-memory problem in a 2024 audit, and the fix stalled for months; it calls that a structural failure of its own decision process.

      Califfirst report 11 Aug

      Working under OpenAI's Patch the Planet project. Calif says knowing PHP's history mattered more than the model.

      OpenAIsame root cause, 11 Aug

      Says that, to its knowledge, AI found these before attackers did, and expects similar findings to rise sharply.

      Wiz Researchreport 24 Aug

      Used Gemini and GPT models. Says one researcher did in about a week what once took a world-class team months.

      Chainguardrediscovered

      Says it found the bug again with its own tooling, one reason it shipped fixed images six hours early.

      PHP's security inbox since 1 July

      Reports to the PHP security team, per the PHP Foundation (21 Oct). It says AI-assisted research has raised the volume sharply.

      The embargo argument

      The PHP Foundation says Chainguard broke the embargo and handed attackers the fix in binary form. Chainguard's CEO says vendors were reporting attacks and the bug was easy to rediscover. Commenters on Hacker News split on whether coordinated disclosure still works when a vague hint is enough to find a bug again.

      Who pays for PHP's security

      A small team funded by the PHP Foundation, plus volunteers. The 2024 audit was paid for by Germany's Sovereign Tech Agency; the Ecosystem Security Team by Alpha-Omega. The Foundation has asked hosts, cloud providers and governments to fund more.

      Compared

      Researchers compare PHP2Shell most often with Heartbleed, for the memory leak (Wiz, Sansec), and with Log4Shell, for a buried component that every company first has to find in its own systems. The earlier PHP flaw closest in kind, CVE-2024-4577, was exploited within a day and used by ransomware; its exposed count fell 96% in nine months. Heartbleed still had about 91,000 exposed servers five years after its fix.

      Trends

      1. AI shortened the clock. Three teams found the bug within weeks of each other, all with AI help, and the PHP Foundation reports more AI-assisted reports than its small team can easily handle. OpenAI and Chainguard both expect more like this.
      2. Embargoes leak sooner. The bug numbers leaked 23 hours before the planned release, PHP moved the release forward a day, and one vendor shipped six hours early anyway.
      3. "Take it offline" became the stopgap. Agencies in the US, UK and the Netherlands advised it before any confirmed break-in, and governments from Czechia to Denmark complied on their own sites.
      4. The long tail is end-of-life PHP. About 1.1 million exposed hosts run branches PHP no longer releases fixes for (VulnCheck). Past bugs suggest a fast first drop and then a residue that lasts for years.
      5. Markets read it as demand for defenders. Cloudflare rose about 5.5% and CrowdStrike about 5.3% intraday on 21 October (Investing.com).
      6. Asia was loudest in Japan. The Prime Minister addressed it, hosts went into emergency maintenance, and a public tally counted 211 organisations. Singapore and Australia issued alerts. As of the evening of 21 October, ThaiCERT had published no notice that this page could find.
      Who

      Half of PHP websites have a fixed release from PHP. The other half depend on a source patch, a vendor's build or an upgrade

      PHP shipped new releases only for the branches it still supports, 8.2 to 8.5; 8.2.35 is the oldest. For 7.4, 8.0 and 8.1 it published minimal source backports, for people who build PHP themselves or have no LTS vendor. Older branches get nothing from PHP. Vendors ship their own fixed builds of older branches under their own version numbers: Ubuntu 22.04 for PHP 8.1, Red Hat for 8.0 and 7.4, CloudLinux for its alt-php and ea-php builds back to 5.2. php.net · Ubuntu · Red Hat · CloudLinux

      Out of every 100 PHP websites, how many can be fixed, and how?

      Each square is 1% of PHP websites, by the version W3Techs detected on 21 Oct 2026. Move the sliders to see what it takes to close the gap.

      ✓Patched ~Fix exists, not applied ✕No patch from PHP
      0patched
      0fix waiting
      0no PHP patch

      51 have a release, 34 a source patch only, 15 nothing from PHP.

      PHP 8.3 and 7.4 are the two biggest groups, on opposite sides of the line

      Share of PHP websites by branch, 21 Oct 2026 (W3Techs).

      ✓Fixed release ~Source patch only ✕No patch from PHP

      PHP 5.x counts every 5 release; the affected code starts at 5.4.0, so sites on 5.0 to 5.3 may predate it, with many other open holes. PHP 4 (0.1%) is left out.

      Five setups in PHP's advisory, mod_php the most exposed

      PHP's advisory names five setups and rates mod_php highest, where an attack works before any application code runs. On PHP-FPM an attack depends on the application or the front end: PHP confirmed code execution through application code paths, including session upload progress after an application error, and FPM is open to CVE-2026-109619 behind a front end that passes PHP_VALUE settings. For CVE-2026-109618, PHP's advisory shows no complete FPM exploit. php.net · GHSA-w8hw · GHSA-6wmf · PHP Foundation

      mod_phpApache module. Highest risk.
      PHP-FPMThe usual nginx setup. Depends on the app or front end.
      php-cgiOlder CGI setups.
      FrankenPHPShips its own PHP.
      LiteSpeedlsphp, common on shared hosts.

      Popular apps confirmed open without a login

      Calif reports these versions as exploitable before login on an unpatched PHP; Wiz reports the same for WordPress and Drupal.

      WordPressWooCommerceMagentoDrupalJoomlaMediaWikiRoundcubephpMyAdminNextcloudLaravelSymfonyWHMCS

      Wikimedia took its Phabricator server offline as a precaution before the patch.

      Site owners and shopsA taken-over server can be wiped, held for ransom, or used to steal card details at checkout.
      Visitors and membersTheir passwords and sessions pass through the same server memory.
      Forgotten serversOld sites and PHP inside appliances. Hal Pomeranz expects a long tail that never gets patched.

      Counts of exposed PHP servers run from 1.3 to 5.1 million

      Each count measures something different. One shared-hosting server can carry many websites.

      The US has the most servers on branches without a new release

      Servers showing PHP 8.1 or older, Shodan scan via Mallory.ai, one source. China is listed without a figure.

      Not exposed: websites with no PHP on the server, such as static pages.

      Fix

      Update PHP, restart every PHP process, then check

      A running PHP process keeps the old code in memory until it restarts. An update without a restart leaves the hole open.

      Where does your PHP run?
      Which PHP branch?

        PHP fix by Hongdamแก้ PHP โดยหงส์ดำ

        Hongdam's team puts a fixed PHP on your site or server. On a server it also restarts PHP, looks for signs of a break-in and sends a report. Bookings set the price: each Monday a busy week moves it up a step, a quiet one down.

        Book a slot on hongdam.net

        A paid service. Hongdam is the studio behind this page. PromptPay, PayPal or Wise; server access is arranged on LINE after payment. PHP older than 7.4: a price after a look, on LINE.

        Fixed versions

        BranchFixed inSecurity support ends
        8.58.5.1231 Dec 2029
        8.48.4.2731 Dec 2028
        8.38.3.3631 Dec 2027
        8.28.2.3531 Dec 2026
        7.4 · 8.0 · 8.1source patch only; distribution or LTS vendor backportsended
        7.3 and oldernoneended

        Distribution builds keep their own numbers: Ubuntu 22.04 8.1.2-1ubuntu2.28, 24.04 8.3.6-0ubuntu0.24.04.13, 26.04 8.5.4-0ubuntu1.5; Debian 12 8.2.35-1~deb12u1 (DLA-4848-1), Debian 13 8.4.27-1~deb13u1; Red Hat 9 PHP 8.0 8.0.30-8.el9_8.1, and Red Hat 8's php:7.4 and php:8.2 streams; CloudLinux ea-php84 8.4.26-2 and alt-php85 8.5.11-5. Debian's tracker lists no Debian 11 package. Read 24 Oct 2026. Ubuntu · Debian · Red Hat · CloudLinux

        On 23 October PHP named a third flaw, CVE-2026-115560, in session upload progress. Cloudflare says it affects fully patched releases, 8.5.12 included. It needs an application that sets session.serialize_handler to php_binary or php_serialize and switches it to php with ini_set() before session_start(), with upload progress on. PHP's notice names session.upload_progress.enabled=0 as the stopgap until its next regular release, which will carry a full advisory. php.net · Cloudflare

        PHP 8.2 is fixed today and out of support in 71 days

        Security support per branch. The red line is 21 October 2026. A move to 8.2 buys ten weeks; 8.3 or newer buys a year or more.

        If you cannot patch within the hour

        These buy time. None makes a server safe.

        ☁️ Cloudflare in front

        Cloudflare added firewall rules for the known attacks on every plan, the free one included. Its CTO calls them a stopgap.
        Cost: covers only traffic that goes through Cloudflare.

        ⚙️ php.net's interim settings

        The advisory lists settings that close some paths, applied in php.ini or the FPM pool with every worker restarted. Read them on php.net.
        Cost: partial, and some trade memory safety for availability.

        🚫 Turn off uploads

        Sansec suggests refusing file-upload requests at the web server for a while.
        Cost: breaks the media library, product photos, and some forms and checkouts.

        🔌 Take it offline

        The UK NCSC advises taking offline any system that cannot be fixed now. Serve a static maintenance page with PHP stopped; WordPress and Magento maintenance modes still run PHP.
        Cost: the site is down until patched.

        After patching, look for a break-in

        Attacks began before the fix, so a patched server can already hold an intruder.

          Sources

          Sources

          First read 21 Oct 2026, 15:15 UTC; news section read to 23:00 UTC the same day. Scores, setups, fixed builds and CVE-2026-115560 re-read 24 Oct 2026 at PHP, NVD and the vendors. Early reports disagree on some details; this page follows php.net where they differ.

          1. php.net, security advisory, 21 Oct 2026: fixed versions, setups, interim settings. php.net, 23 Oct 2026: CVE-2026-115560.
          2. PHP's advisories GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): scores, setups, FPM paths. NVD CVE-2026-109618, NVD CVE-2026-109619: CVSS 3.1 scores.
          3. Debian security tracker and Red Hat security data, read 24 Oct 2026: fixed packages.
          4. Sansec, PHP2Shell: confirmed apps, timeline, stopgaps, history since 2004.
          5. Tenable, FAQ: ratings, leak, Cloudflare, host estimates by Silas Cutler and Henk Poley.
          6. Wikipedia, PHP2Shell: discovery under OpenAI's Patch the Planet, advisory titles, 13:34 UTC advisories, Wikimedia.
          7. Help Net Security: Kevin Beaumont, Hal Pomeranz, NCSC, Remi repository.
          8. BleepingComputer: VirusTotal host count, Gina Peter Banyard.
          9. Phoenix Security: Mallory.ai Shodan counts by version and country, signs of a break-in.
          10. Mattias Geniar: commands per platform, restarts, checking for old PHP in memory.
          11. Ubuntu and USN-8948-1: fixed package versions.
          12. Wordify, live updates: 08:44 and 12:00 UTC reports, PHP support dates.
          13. W3Techs: PHP share of websites and version split (8.x, 7.x), 21 Oct 2026.
          14. PHP Foundation, 21 Oct: timeline, 2024 audit, inbox figures, embargo, funding.
          15. Cloudflare, Patchstack, Hadrian, watchTowr, VulnCheck, Huntress, SecurityWeek: attack reports and host counts.
          16. Amazon, 21 Oct: first attempt on its decoy servers 17 Oct, more from 02:00 UTC on 21 Oct.
          17. OX Security: hosts showing a patched version. Precursor live blog: exploit repos.
          18. CISA, UK NCSC, CERT-EU, CSA Singapore: advisories.
          19. Reuters factbox via Euronext, Insurance Business, Techzine, The Record, piyolog, ITmedia, Wikimedia: sites taken offline.
          20. Digital Applied fix tracker, USN-8948-1, CloudLinux status: the patch race.
          21. Wiz, Fortune, Decrypt, TNW, Socket, The Record: discovery, AI and the embargo dispute.
          22. Investing.com: share prices.
          23. Comparison figures: Heartbleed, Shellshock, Log4Shell, Shodan on EternalBlue, Censys on CVE-2024-4577, Emsisoft on MOVEit, The Register on Citrix Bleed, Qualys on regreSSHion, Security Affairs on CVE-2019-11043.
          24. Forbes and Laravel News: release notice.