The PHP2Shell vulnerability has triggered millions of reported exploitation attempts against internet-facing infrastructure, putting pressure on organizations that rely on PHP to run websites and web applications. Cloudflare CEO Matthew Prince reported that attempts observed across his company’s network rose from thousands before public disclosure to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions afterward. Those figures describe attempts, not confirmed intrusions.
The PHP development team released security updates on October 21, 2026, addressing two critical vulnerabilities that can allow remote code execution without authentication under affected conditions. The incident also highlights an emerging cybersecurity challenge: AI-assisted research can help expose weaknesses in widely deployed software that remained difficult to exploit for years. For website operators, the immediate priority is to identify affected systems and install the appropriate fixes.
What the PHP2Shell vulnerability actually affects
PHP2Shell refers to two critical vulnerabilities in PHP’s core runtime, rather than a flaw limited to a particular website builder or content management system.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both received CVSS version 4.0 severity scores of 9.2, according to the NHS England cybersecurity advisory. Successful exploitation can allow an unauthenticated attacker to execute code remotely or access sensitive data in PHP process memory.
PHP runs on web servers to generate dynamic pages and process application requests. It is also used by platforms such as WordPress, Drupal, and Joomla, as well as Wikipedia’s MediaWiki software.
Wiz Research says PHP powers approximately 70% of websites worldwide. That figure describes PHP’s reported reach across the web; it does not mean that 70% of all websites have been successfully compromised or are equally exposed to every attack path.
Because the vulnerabilities reside in the PHP runtime itself, changing a website’s theme or updating its content management system alone does not necessarily fix the problem. Operators must verify the PHP version running on their servers and determine whether the installed build contains the security patches.
AI helped researchers expose the underlying weaknesses
The PHP2Shell disclosure demonstrates how AI-assisted research can help security specialists investigate vulnerabilities in mature software.
Wiz Research identified flaws involving memory handling in PHP’s core engine. The technical issues include problems associated with out-of-memory error handling, stale internal state, and memory-safety failures. Under affected conditions, these weaknesses can expose process memory or allow an attacker to execute code remotely.
According to Wiz, demonstrating exploitability required a complicated series of steps that would have been difficult for human researchers to reproduce and develop into a working exploit. AI models helped reduce that barrier.
The research also involved collaboration between multiple organizations. OpenAI reported that Calif identified a critical flaw using GPT-5.6 Sol as part of its Patch the Planet initiative, while Wiz independently discovered and reported both PHP vulnerabilities. PHP’s maintainers led the development and release of the fixes.
That distinction matters. AI contributed to vulnerability research and exploit development, but the research does not establish that AI autonomously conducted the attack attempts subsequently observed across security networks.
The broader concern is that software weaknesses previously considered difficult to exploit may become more practical targets as research tools improve. The same technology can also help defenders discover those weaknesses and develop patches before more attackers learn how to use them.
Exploitation attempts were detected before public disclosure
The surge in reported activity did not necessarily begin when the vulnerabilities became public.
Amazon Threat Intelligence reported detecting a PHP2Shell exploitation attempt against its MadPot honeypot network on October 17, four days before the public disclosure and release of the patches. The attempt originated from an IP address associated with a commercial anonymization network. Amazon said it remained unclear whether the observed attempts would have succeeded against real-world systems.
After the disclosure, Cloudflare reported a rapid increase in the number of attempts observed across its network. Matthew Prince described a progression from thousands of attempts in the hours before disclosure to tens of thousands in the first 45 minutes, hundreds of thousands within two hours, and millions by October 22.
These reports illustrate how quickly attackers can begin testing a newly disclosed vulnerability. They also show why defenders cannot rely solely on the public announcement date when investigating possible activity against their systems.
The available evidence should nevertheless be interpreted carefully. An exploitation attempt against a honeypot, a blocked request, and a successful intrusion are different events. The volume of reported attempts does not establish how many real websites, if any, were successfully compromised.
Why governments and organizations took websites offline
Some organizations temporarily removed online services from public access while assessing their exposure and applying security updates.
In the United Kingdom, 32 government services had been taken offline by October 22, according to reporting by The Guardian. Officials said the shutdowns were largely precautionary while updates were applied. The U.K. National Cyber Security Centre had also sent 50,000 alerts to affected organizations. The government said no public-facing critical services had been affected by those temporary shutdowns.
The response reflects the potential consequences of a vulnerability in widely deployed server software. A compromised web server can expose sensitive information, disrupt a service, or provide an attacker with access to computing resources that can be abused for other purposes.
U.S. and U.K. authorities have urged organizations to prioritize security updates. The U.K. NCSC advises organizations to identify systems running PHP, prioritize internet-facing infrastructure, monitor suspicious activity, and apply the relevant fixes. It also says organizations should consider taking systems offline when immediate remediation is not feasible.
A temporary shutdown does not itself indicate that a site has been hacked. In this case, precautionary shutdowns were part of the response to a potentially serious vulnerability.
Which PHP versions contain the security fixes?
LOOP TECK / SECURITY PATCH TRACKER
Which PHP Versions Contain the Security Fixes?
Select a PHP release branch to view its fixed version. Check your actual server version before assuming the update is installed.
Selected fixed release
PHP 8.5 8.5.12
Use this fixed version as your reference when checking your installation.
Vulnerabilities addressed: CVE-2026-109618 and CVE-2026-109619. Apply the appropriate update for your PHP installation.
Running PHP 8.1 or an older release?
PHP 8.1 and earlier no longer receive regular security updates directly from the PHP project. Some distributions and long-term support vendors may provide backported fixes.
Limited source backports were also published for PHP 7.4, 8.0, and 8.1. Do not assume your installation is protected merely because your vendor offers a backport; confirm that the relevant vulnerabilities are covered by your specific package.
Important: The fixed versions listed above do not establish the patch status of every older branch or vendor package. Contact your hosting provider if that information is unclear.
Website owner verification checklist
Security reminder: Updating WordPress, themes, or plugins does not necessarily update the server’s PHP runtime. Verify the actual PHP installation and consult your vendor’s security advisory.
What website owners should do now
Website owners and administrators should treat PHP2Shell as a server-level security issue and take the following steps.
1. Identify all systems running PHP. Check websites, application servers, and other services that may include PHP. Prioritize systems exposed to the internet.
2. Verify the installed version. Compare the running PHP build with the official fixed releases or a verified vendor backport. A control panel showing an available update does not necessarily prove that every application is already running the patched build.
3. Apply the appropriate security update. Upgrade to a fixed release for the relevant PHP branch or follow the supported remediation guidance from the distribution or hosting provider. Restart PHP workers and services as required by the deployment so that the patched runtime is actually active.
4. Review third-party hosting and software updates. Managed hosting platforms, server panels, and operating-system packages may distribute PHP differently. Confirm that the vendor’s specific update addresses both vulnerabilities.
5. Check for suspicious activity. Review relevant web-server and application logs, investigate unexpected processes or file modifications, and follow official security guidance when assessing possible exploitation attempts. An update prevents exposure to the patched flaws but does not automatically establish that an earlier intrusion did not occur.
6. Reduce exposure if you cannot patch promptly. The PHP security team says an update is the complete fix. Interim measures may reduce some attack paths, but they are not a substitute for patching. If immediate remediation is not feasible, follow official guidance on restricting exposure or temporarily taking the affected service offline.
These actions are particularly relevant to smaller organizations that depend on third-party hosting and may not know which PHP version is serving their websites.
Do millions of attempts mean that websites have been hacked?
No. The number of reported attempts cannot be used as a count of successful compromises.
As of October 23, public reporting reviewed for this article establishes that exploitation attempts have been observed, researchers have demonstrated the vulnerabilities under affected conditions, and security teams are responding. The Guardian reported on October 22 that the U.K. NCSC had no reports of successful hacks tied to the flaw at that time. Amazon’s earlier telemetry also distinguished observed attempts from confirmed successful exploitation.
That does not make the threat harmless. A vulnerability capable of enabling unauthenticated remote code execution can have serious consequences when an attacker finds a viable path into a vulnerable environment.
It does mean that security reporting should distinguish three separate facts: a vulnerability exists, attackers are attempting to exploit it, and a particular system has been compromised. Conflating those claims can mislead website owners about the scale of the incident and the evidence needed for an investigation.
Practical Takeaway
The immediate lesson from PHP2Shell is that widely deployed software can carry serious weaknesses for years, and the window between public disclosure and automated attack activity can be extremely short.
Website owners should verify their actual PHP versions, apply the relevant fixes, and investigate suspicious activity instead of relying on the reported attack count as evidence of compromise.
For unsupported PHP installations, confirming whether a vendor has supplied a backported fix is especially important. If the system cannot be patched promptly, operators should follow official guidance to reduce exposure or take the service offline until it can be secured.
The next important question is how quickly organizations can identify vulnerable systems and complete remediation before exploitation attempts lead to confirmed incidents.
LOOP TECK SECURITY BRIEF CRITICAL FLAW
PHP2Shell Vulnerability: FAQs
What website owners need to know about PHP2Shell, the reported surge in exploit attempts, affected PHP versions, and available security fixes.
01 What is the PHP2Shell vulnerability?
PHP2Shell refers to two critical vulnerabilities in PHP’s core runtime. Under affected conditions, the flaws may allow an unauthenticated attacker to execute code remotely or access sensitive information in PHP process memory.
02 Why is the PHP2Shell flaw considered serious?
PHP runs server-side code for websites and web applications. If an affected server can be exploited, an attacker may gain unauthorized code execution, access sensitive data, or disrupt services. The actual risk depends on the PHP build and the environment in which it runs.
03 Does this mean 70% of websites have been hacked?
No. The reported figure refers to PHP’s widespread use across the web. It does not mean that 70% of websites have been compromised or that every PHP-powered website is necessarily vulnerable. Exposure depends on the installed version, security updates, and deployment.
04 Which PHP versions contain the reported security fixes?
The fixed releases listed in the article are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. Administrators using older branches should ask their operating-system or hosting provider whether a verified security backport is available.
Check the official PHP release announcements and confirm the fix for your specific installation.
05 Do millions of exploit attempts mean millions of successful attacks?
No. Exploitation attempts are not the same as confirmed breaches. Security systems can record blocked requests, automated probes, and other attempts without an attacker gaining access. Organizations should investigate their own systems instead of treating the reported attempt count as a count of compromised websites.
06 How can website owners protect their websites from PHP2Shell?
First, identify the PHP version that is actually running. Apply the appropriate fixed release or verified vendor backport, then restart affected services when required. Review relevant server logs for suspicious activity and confirm the update with your hosting provider if PHP is managed on your behalf.
If you cannot patch promptly, follow official security guidance to restrict exposure or temporarily take the affected service offline. Interim precautions do not replace installing the fix.
07 Will updating WordPress or its plugins fix PHP2Shell?
Not necessarily. PHP2Shell concerns the PHP runtime itself, so updating WordPress, a theme, or a plugin alone does not guarantee that the vulnerable PHP version has been fixed. Check the server’s PHP installation and ask your hosting provider to confirm that the relevant patch is active.
08 How did AI contribute to the PHP2Shell discovery?
AI-assisted research helped specialists demonstrate how difficult-to-exploit PHP flaws could be turned into practical exploits. This lowered a technical barrier for researchers. However, the use of AI in vulnerability research does not establish that AI autonomously carried out the subsequent exploitation attempts observed across security networks.
GTA VI: The Bigger Picture
A closer look at the gaming industry’s biggest upcoming release, the expectations surrounding it, and what GTA VI could mean for the future of gaming.
Watch the Full Breakdown
Hit play and explore the story behind GTA VI, the expectations surrounding Rockstar’s next major release, and why the game has become such an important moment for the wider gaming industry.
The scale of anticipation surrounding the title makes it an interesting case study in modern gaming — from blockbuster franchises and consumer attention to hardware demand, entertainment culture, and the changing relationship between players and major game publishers.
The important question is not simply how successful GTA VI will be. It is how much influence one major release can have across the wider gaming ecosystem.
