Two Bugs, Half the Web Offline: My Take on PHP2Shell

On Wednesday morning (October 21) I tried to open a government advisory page and got a maintenance notice. Then a second one. By lunchtime I had stopped counting. Ministries in France and Finland, the Dutch government portal, Australia’s own cyber.gov.au, parts of Wikimedia, 4chan and a long list of Japanese game and shopping sites had all gone dark, and almost none of them had been hacked. They pulled themselves offline on purpose.

I have read most of what was published in the last three days. Here is what happened, what the vendors did, and what I think we should learn from it.

What is PHP?

PHP is an open-source, server-side scripting language designed primarily for web development and creating dynamic, interactive web pages. Unlike client-side languages like JavaScript, which run directly inside a user’s web browser, PHP code executes entirely on the web server. The server processes the PHP code and returns standard HTML to the user’s browser, keeping the underlying code hidden from the client.

Also see: What is PHP and why did it spark a global cyber-security scramble?

What happened

• Two critical bugs were found in PHP itself, the language behind about 69 percent of websites. They are tracked as CVE-2026-109618 and CVE-2026-109619, and Wiz Research named them PHP2Shell.
• Both score 9.2 out of 10. They let an attacker run code on a server without logging in.
• They were found by Calif, and separately by Wiz, both using AI models. Calif’s work came partly through OpenAI’s program for security researchers.
• Fixes shipped on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Attackers were already using them. Amazon spotted a probe four days before the fix, and attacks went broad on release day.

Why it matters

• Governments, Wikimedia and major websites chose to switch themselves off rather than risk being taken over. The NSA told them to, and so did the UK’s NCSC.
• Most exposed PHP servers run versions that will never get an official fix.
• The gap between a patch and a working attack was under an hour.

And here is the part that kept me reading long past midnight. The bugs were not the scariest thing about this week. The way the fix reached the world was. Hold that thought, because we will get there.

The aftermath

A week after the disclosure, the world is still reeling from the shock of this disclosure. But how severe was the impact of this disclosure? And to what extent has it been exploited? How did the world react with corrrective action?

CISA Intervention: On October 26, the Cybersecurity and Infrastructure Security Agency (CISA) added both CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog, setting a federal civilian agency remediation deadline of October 29.

Chained Attacks & Kernel Exploits: Security researchers and firms (including Dream and Palo Alto Networks’ Unit 42) documented active campaign chains combining php2shell with a Linux kernel privilege escalation flaw named Fragnesia (CVE-2026-46300), which CISA subsequently added to the KEV catalog on October 28. Attackers used this chain to root perimeter firewalls and management servers across the U.S., Japan, Taiwan, and South Korea.

Honeypot Activity: By October 24, honeypot sensors recording single-worker Apache mod_php setups running PHP 8.4.26 logged dozens of shell execution attempts.

New Secondary Risks: Following the initial patch, a third related unauthenticated RCE risk (CVE-2026-115560, tied to session upload progress) surfaced, prompting recommendations to disable session.upload_progress.enabled alongside running core version updates.

Remediation Status: Patches remain available across PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (with backports for older branches), though security teams noted that simply updating binaries does not take effect until PHP workers are explicitly restarted.

Source: TechTarget, Tenable and other sources.

See: PHP2Shell explained: Timeline of the global vulnerability crisis

Republished with permission from FieldCISO Advisory.