Hackers Launch Millions of Attacks as Critical PHP Flaws Threaten Websites Worldwide: What You Need to Know

The flaws risk remote code execution and data theft, prompting agencies to urge immediate patching

NSA PHP advisory — The NSA issued a rare public advisory on the PHP2Shell vulnerabilities, warning that cyber actors are likely to exploit them Screenshot from NSA Website

Web administrators spent this week scrambling to patch two critical flaws in PHP, the software behind a large share of the world's websites, after security firms began logging live attacks and the US National Security Agency told organisations to update immediately.

The two bugs, tracked together as PHP2Shell, let an attacker seize control of a web server with no password, no login, and no prior foothold. Both carry a severity rating of 9.2 out of 10 on the CVSS v4.0 scale, near the top of the critical band. The PHP security team shipped emergency fixes on Wednesday, 21 October, a day earlier than planned.

The reason for the rush sits at the centre of this story. On 20 October, a day before the coordinated release, the technical details leaked. A working proof-of-concept tool named PHP2Shell surfaced online, broke the embargo, and forced the disclosure forward. Within hours, the attacks followed.

Cloudflare said it had observed attack traffic aimed at its customers, with attackers mutating their payloads to slip past defences. The company's chief technology officer, Dane Knecht, said, 'We are seeing early attacks emerging and are updating mitigations as new vectors show up.' Security firm watchTowr reported active exploitation attempts against both flaws, and Patchstack said it had confirmed multiple active exploitation incidents.

How Deep the PHP Flaws Really Go

What makes PHP2Shell so dangerous is its location. The weakness lives in the PHP runtime itself, not in any single website, plugin, or theme. Updating your site's code changes nothing. Only patching PHP closes the hole.

The first flaw, CVE-2026-109618, lets an attacker run their own code on the server with the privileges of the web worker. The second, CVE-2026-109619, abuses stale memory left behind after a crash, which a later request can exploit to leak sensitive data or achieve the same remote takeover. Reaching the server over the network is enough.

Affected setups cover nearly every common way of serving PHP, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team rates the risk highest for mod_php, where an attack can succeed before any application code even runs, and where a working exploit has already been demonstrated. Public reporting traces the flaws back as far as PHP 5.4, released more than a decade ago.

The flaws were uncovered by researchers at Wiz, Calif, and OpenAI's Codex security team, who worked with PHP maintainers on the fix. That an artificial intelligence lab helped find a hole this deep in the internet's plumbing is, on its own, a measure of how the hunt for software bugs is changing.

What Website Owners Need to Do About PHP2Shell

The exposure is wide. Scans by Shodan found roughly 884,000 internet-facing hosts running PHP 8.1 or older, with hundreds of thousands more whose version could not be read, and broader estimates put reachable PHP hosts well into the millions. None of those counts are confirmed compromises, but each is a server now in range of a public exploit.

Patched builds are available as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Given the severity, the security team also issued minimal backports for the older PHP 7.4, 8.0, and 8.1 branches, which no longer receive standard support. Anything on PHP 7.3 or earlier gets no fix and should be moved off.

Administrators are advised to inventory PHP at the runtime level rather than trusting application dependency lists, since bundled platforms such as WordPress, Drupal, Joomla, and Magento all ship PHP underneath. Internet-facing systems come first.

The guidance from every quarter is the same. The UK's National Cyber Security Centre told organisations to update at once or take systems offline until they can. The NSA urged American agencies to inventory affected services, watch internet-facing devices closely over the coming weeks, and replace end-of-life installs.

Temporary workarounds exist, such as adjusting memory limits and disabling certain upload features, but the PHP team was blunt that these only narrow the window. Gina Peter Banyard, a PHP core developer, put the limits of any half-measure plainly, saying, 'I sadly know too much.' Patching remains the only permanent fix.