On the night of October 21, 2026, Australia's national cybersecurity agency took its own website, cyber.gov.au, offline. Government sites in France, Finland, Denmark and the Netherlands went dark too. The reason was PHP2Shell, a pair of critical flaws in PHP, the software that runs WordPress and most business websites, that let a stranger run commands on a web server without a password. If your website runs on PHP, confirm this week that it's on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a patched build from your host) and that PHP was restarted after the update.
Updating WordPress, your theme or your plugins does not fix this. The flaw is one layer below your website, in PHP itself, and that's exactly why so many small business sites will stay exposed. Below is what happened day by day, what hosts and admins ran into, the numbers that explain the rush, a 10-minute check you can do yourself, and the fixes in order.
What happened: a week of PHP2Shell, day by day
Saturday, October 17. Amazon's honeypot network logged a PHP2Shell exploitation attempt, four days before the flaws were made public. AWS chief information security officer CJ Moses said the attempt came from an IP address tied to a commercial anonymization network, and warned that "defenders should not assume the public disclosure date is the earliest date of exploitation" (BleepingComputer (opens in a new tab)). Amazon also said it was unclear whether any of those early attempts would have worked on real systems.
Tuesday, October 20. The CVE numbers leaked online, and the PHP project moved its release forward. That evening, one of the research firms behind the discovery accidentally published a video of its exploits working against several targets (iTWire (opens in a new tab)).
Wednesday, October 21. PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC, early morning in Los Angeles. The release note didn't hedge: "There are no complete mitigations, updating is the only safe choice" (PHP (opens in a new tab)). CISA issued an alert the same day urging immediate patching, and governments started pulling their own sites. Hostinger, one of the large web hosts, said it applied protections that day and rolled out patched PHP versions across its whole platform on October 22 (Hostinger (opens in a new tab)).
October 22 to 25. The attacks came quickly. Cloudflare reported early attacks and released emergency firewall rules, and Patchstack confirmed attack activity (iTWire (opens in a new tab)). Hostinger's write-up cites Wordfence, the WordPress security plugin, reporting more than 74,000 blocked exploit attempts. On October 23, CISA updated its alert with a detection rule that admins can run against their logs.
Monday, October 26. Two things happened. A detection and response lead at Perplexity, Adel Karimi, recorded working exploitation in honeypots against Apache with mod_php on PHP 8.4.26, and said: "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process" (BleepingComputer (opens in a new tab)). He was careful to note his setup was deliberately favorable to the attacker. The same day, CISA added both flaws to its Known Exploited Vulnerabilities catalog (opens in a new tab) with a three-day deadline for federal agencies. PHP also pushed rebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) to fix a separate flaw in the bundled Brotli library, which CISA added to its list the next day.
Wednesday, October 28. CISA added a Linux kernel flaw, CVE-2026-46300, and noted it can be chained with the two PHP flaws to plant webshells and run commands as root, the all-powerful administrator account. For anyone running their own Linux server, that turns a website break-in into losing the whole machine.
To be accurate about where things stand: Hostinger wrote that, as of October 26, no successful PHP2Shell break-in had been publicly confirmed, and Karimi's confirmed case was a honeypot, not a real business. Researchers have shown it works, governments are treating it as an emergency, and CISA lists it as exploited. Waiting for the first public victim before acting is the wrong bet.
What an attacker gets, and how many sites are exposed
The two flaws are CVE-2026-109618 and CVE-2026-109619, and PHP rates both 9.2 out of 10. In plain terms, when a web request is cut off in the wrong place, PHP can leave its memory in a broken state, and a later request can take advantage of it. The result is remote code execution without a login: a stranger on the internet makes your server run their code.
The attacker gets the same access your website has. That usually includes the files that make up the site and the database behind it, which is where contact form submissions, appointment requests, customer accounts and order history live. From there they can change pages, add a hidden file that lets them back in whenever they want (a webshell), or host phishing pages under your domain name, which is especially damaging for a law firm or medical office whose clients trust its emails and links.
Every PHP setup that serves web pages is affected, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, according to CISA's alert (opens in a new tab). PHP's security team called mod_php the highest risk (BleepingComputer (opens in a new tab)), and CrowdStrike verified that a single anonymous request could make a mod_php worker launch a shell (iTWire (opens in a new tab)). CISA also warns that "PHP is often a component of other software and prevalence may not be directly observable," so the website you know about may not be the only PHP on your network.
The numbers
PHP runs 69.2% of all websites whose server-side language is known, according to W3Techs (opens in a new tab) data from October 2026. Of those PHP sites, 26.5% are still on PHP 7 and 7.6% on PHP 5, versions that stopped getting fixes years ago. VirusTotal estimates put more than 5.1 million PHP hosts exposed online (BleepingComputer (opens in a new tab)). This isn't PHP's first time on CISA's list, either: a PHP flaw on Windows servers, CVE-2024-4577, was added in June 2024.
The bigger trend explains the urgency. Google's Mandiant reported in March 2026 that the mean time to exploit has dropped to an estimated minus 7 days, meaning exploitation routinely starts before a patch exists, and that exploits were the top way into networks for the sixth year running, at 32% of intrusions (Google Cloud, M-Trends 2026 (opens in a new tab)). PHP2Shell followed that script exactly. Verizon's 2026 Data Breach Investigations Report found exploited vulnerabilities started 31% of breaches, and only 26% of the critical flaws on CISA's exploited list were fully fixed, with a median of 43 days to get there (Help Net Security (opens in a new tab)). Forty-three days is a long time to leave a front door open when the attackers showed up four days early.
What site owners and admins actually ran into
'We updated WordPress, so we're fine'
The most common mistake is also the most understandable one. The website owner sees WordPress updates in the dashboard, clicks them, and assumes the site is current. But a PHP update never appears in the WordPress dashboard. iTWire (opens in a new tab) put it plainly: updating WordPress, Drupal or Magento alone will not fix these flaws. Meanwhile, the web agency that built the site assumes the host handled PHP, and the host may be waiting for the customer to pick a newer version. Everyone thinks someone else did it.
Shared hosting versus your own server
Who has to act depends on what you pay for. Hostinger told its managed hosting customers, "If you're on any of our managed web hosting plans, you're all set." Its virtual private server customers got the opposite message: "you manage PHP yourself, so the update is your responsibility" (Hostinger (opens in a new tab)). Check which side of that line your plan falls on. If your developer set you up on a VPS or a cloud server years ago, nobody is patching PHP for you unless someone is paid to.
Patched, but still exposed
It's easy to install the new PHP package and move on without restarting anything. Security experts quoted by iTWire, including Qualys and Securonix, say to restart the web server and PHP workers so the fix takes effect. Until that restart, the old code keeps answering requests. Version numbers can mislead too: PHP notes that some Linux distributions and long-term support vendors ship their own backported fixes, so a patched server can still show an older-looking version number. The only reliable answer comes from whoever manages the server.
Old PHP with no fix at all
Sites on PHP 8.1, 8.0 or 7.4 hit a wall. The PHP project no longer releases updates for them. Its security team published minimal source code fixes for those three versions, but those are for people who compile PHP themselves, not for a typical business site. Anything older got nothing. CISA's advice for systems that can't be updated, or that run PHP 8.1 or earlier, is to take them offline until they're patched or upgraded.
Windows servers needed a second update
Businesses running PHP on Windows servers, for example behind IIS for an older line-of-business web app, had one more step. PHP's October 26 rebuilds with the -1 suffix fixed a flaw in the Brotli compression library bundled with the Windows builds. If you updated PHP on Windows on October 21 or 22, you need the rebuild too.
Signs that someone got in
CISA's alert tells defenders to "Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools." The guidance iTWire summarized adds what to look for in the logs: unusual POST or multipart (file upload) requests, memory exhaustion errors, repeated PHP worker crashes, and programs started by PHP that have no reason to run. CISA published a SIGMA detection rule for this, which a security team or managed provider can load into their log tools. Because Amazon warned that the disclosure date isn't the earliest date of exploitation, review logs back to at least October 17, not just from the day of the patch.
If anything looks wrong, the response guidance is blunt: isolate the server, rebuild it from a clean copy, and change the database passwords and API keys the site used. Restoring the same server from last week's backup isn't enough if the attacker has been in since before then.
The scam emails that follow
Big security news brings phishing. iTWire warned that ordinary users don't need to install anything for PHP2Shell, but should be wary of fake security alerts and password reset notices. Expect emails claiming 'your website was hacked' with a link to log in and fix it. Go to your host's site directly instead of clicking.
Your 10-minute self-check: find your PHP version and who owns it
You can learn most of what you need in ten minutes without touching the server.
Minutes one to three: list every site. Write down your main website, any old campaign or landing page sites, staging copies your developer made, online stores, client or patient portals, and any web-based tool someone in the office uses. If you're not sure, check your domain registrar account for every domain you own and see which ones load a website.
Minutes four to six: find the PHP version. In WordPress, log in, go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version is listed there. On cPanel hosting, the MultiPHP Manager or Select PHP Version page shows it for each site. Then run each domain through our free website security check. If your server advertises its PHP version in its headers, the check flags it, which is both a quick way to see the version and a leak worth closing, because it tells attackers exactly what to try.
Minutes seven to eight: compare against the table. Use the fixed-version table in the next section. Anything below the fixed version for its branch is exposed. Anything on 8.1 or older is exposed and has no official fix.
Minutes nine and ten: find out who owns it. Write next to each site who runs the server: your host on a managed plan, a developer on a VPS, or you. Then take our free security score. One of its 12 questions asks whether security updates for computers, servers and firewalls go on within 14 days. If PHP on your website wasn't part of your answer, add it.
The fixes, in order: versions, emails and what to do if you can't patch
| PHP branch | Fixed version | What to know |
|---|---|---|
| 8.5 | 8.5.12 | Update now |
| 8.4 | 8.4.27 | Update now |
| 8.3 | 8.3.36 | Update now |
| 8.2 | 8.2.35 | Update now. Security fixes for 8.2 end December 31, 2026 |
| 8.1, 8.0, 7.4 | No official release | End of life. Get a vendor backport or upgrade to 8.3 or newer |
| 7.3 and older | None | End of life. Upgrade |
1. Send your host or developer one clear email today. Ask three things. Is PHP on our server updated to a version that fixes CVE-2026-109618 and CVE-2026-109619? Were PHP and the web server restarted after the update? If we're on PHP 8.1 or older, what's the plan and date to upgrade? iTWire advises shared hosting customers to ask the provider to confirm PHP is patched on every instance. Get the answer in writing, and keep it with your security records.
2. If you run the server, patch PHP and restart everything. Update to the fixed version for your branch, or your Linux vendor's patched package, then restart PHP-FPM, Apache or whatever serves your site. On Windows, install the -1 rebuild. On Linux, also patch the kernel for CVE-2026-46300, which CISA gave federal agencies until October 31 to fix.
3. If you can't patch this week, take the site offline. That's CISA's guidance (opens in a new tab), and it applies to anything on PHP 8.1 or older. A few days with a 'back soon' page costs far less than cleaning up a hacked server and notifying customers. A web application firewall, like the emergency rules Cloudflare released, can buy time while you plan, but PHP's own position is that no workaround makes an installation safe.
4. Check the logs back to October 17. Ask whoever manages the server to look for the warning signs above, or to run CISA's detection rule. If anything looks wrong, isolate and rebuild, then change database passwords and API keys. If customer or patient data was on that server, read our guide to California's data breach notification law and follow your incident response plan before telling anyone anything.
5. Clean up the forgotten sites. Old campaign sites and staging copies are the ones nobody patches. If you don't need them, take them down. If you do, put them on the same update schedule as your main site. Our website security guide covers the other gaps these sites tend to have.
6. Plan the PHP 8.2 move before December 31. If you land on 8.2.35, you're fixed for now, but PHP 8.2 stops receiving security fixes on December 31, 2026. Ask your developer to test the site on 8.4 or 8.5 before year end, so you aren't doing this again in January under pressure.
How GlobeVM helps Los Angeles businesses with exposed websites
The hard part of PHP2Shell isn't the fix. It's working out who owns each piece and getting a straight answer from each of them: the host, the agency, the developer who moved away. That's a good job to hand to an IT partner. GlobeVM has been in business for more than 30 years, and when you call, you reach George or Nazy directly, not a call center. Firewall management, endpoint protection, email filtering and MFA come standard in every plan, and our response time is 15 minutes, around the clock.
For healthcare and dental practices, a patient intake form on an exposed site is a HIPAA problem waiting to happen, so this deserves attention this week. If you're not sure where your sites and servers stand, book a free IT assessment. For an ongoing view of what's exposed, see our threat detection service.