The PHP project issued emergency security updates on Wednesday fixing two critical vulnerabilities that can allow an attacker to take control of a web server without any login credentials, a flaw set researchers have nicknamed “php2shell.” The disclosure set off a global scramble to patch, and several European governments took public websites offline as a precaution while they applied the fixes.
Both vulnerabilities are rated 9.2 out of 10 in severity under the CVSS v4.0 scoring system. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert the same day “strongly urg[ing] organizations to immediately patch” and warning that the flaws “allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests.” PHP runs a large share of the world’s websites, including most WordPress sites, which is why a bug in the language itself, rather than in any single application, forced such a broad emergency response.
What the two flaws do
The first flaw, tracked as CVE-2026-109618, sits in PHP’s handling of out-of-memory errors. When a request exhausts its memory limit, PHP aborts it using a mechanism that can leave internal request data only partially initialized; cleanup code then treats that invalid data as trustworthy, a corruption a carefully crafted request can turn into code execution. PHP says a complete exploit was validated over ordinary web requests against servers running Apache with mod_php, the configuration it considers highest-risk, and that confirmed attack paths include the parsing of multipart form uploads.
The second flaw, CVE-2026-109619, is a use-after-free error: state belonging to one request, such as error, session or object data, can survive after its memory has been released, and a later request handled by the same worker process can be made to use that stale state. Confirmed paths include PHP’s session upload-progress feature, which is enabled by default, against both mod_php and PHP-FPM servers.
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering every supported branch. Every earlier release in those branches is vulnerable, and the two problems were serious enough that PHP also took the exceptional step of publishing minimal source-code backports for the long-unsupported 7.4, 8.0 and 8.1 lines. For the current branches, PHP is blunt: updating is the only complete fix, and configuration changes can only narrow some of the attack paths.
Governments take sites offline, as a precaution
The visible disruption came mostly from defenders, not attackers. According to a Reuters factbox published Wednesday, many Dutch organizations followed their national cybersecurity center’s guidance and “preventively took their public-facing sites offline,” among them the Port of Rotterdam, the government’s Overheid.nl portal, the KNVB football association, hospital websites and the sites of the country’s five largest political parties. In Finland, the state IT provider Valtori shut down government public web services “as a precautionary measure,” saying it had not identified any attempt to exploit the flaws and that the outage was not the result of a data breach. France’s Interior Ministry temporarily took prefecture websites offline while awaiting a fix, Belgium’s foreign ministry took its websites down, and the Czech government took its site offline on its cyber watchdog’s recommendation so patches could be applied.
The Wikimedia Foundation, which runs Wikipedia on PHP-based software, told Reuters it “was in the process of addressing security vulnerabilities in the PHP programming language” and had “taken down a number of other systems as a precautionary measure until they can be safely patched.” Wikipedia itself saw a sharp spike in access problems late Wednesday morning Eastern Time, with thousands of user reports on outage trackers, and Wikimedia’s status page listed an emergency maintenance incident. Researchers credited with discovering and reporting the flaws include teams from Wiz, OpenAI’s Codex Security effort and Calif.
Attempts seen, no confirmed breach wave
The careful distinction in Wednesday’s reporting is between attacks attempted and attacks that succeeded. CISA said it had “not observed exploitation of these vulnerabilities” when its alert was published, neither flaw appears in CISA’s Known Exploited Vulnerabilities catalog, and PHP’s security team said it had identified no functional exploits in the wild at the time of release. Security vendors, however, reported hostile traffic within hours: the firm watchTowr told The Register it was already observing in-the-wild exploitation attempts using “php2shell” identifiers, “whilst nobody has been successful to date,” and Cloudflare reported attack traffic against its customers from early Wednesday. In other words, the race is on, but as of Wednesday there was no publicly confirmed case of a server compromised through these flaws.
What happens next
The emergency release was not on PHP’s normal schedule: it had been planned for Thursday and was moved a day earlier after the vulnerability identifiers leaked on forums and social media on Tuesday, briefly accompanied by exaggerated claims, including a perfect 10.0 severity score that PHP’s official 9.2 rating does not support. The practical consequence is a patching window measured in hours, not weeks, because a working exploit against a flaw this broad is expected to circulate quickly. Site owners are being told to update to the fixed PHP releases immediately, or, in the Register’s summary of official advice, to pull unpatched sites offline until they can. Hosting companies and control-panel vendors are expected to push the fixed versions over the coming days, and security agencies in the United States, Britain and the EU say they will be watching for the first confirmed compromises.
Sources: PHP.net security advisory, October 21, 2026; PHP GitHub security advisory GHSA-w8hw-w9fx-j79w; CISA alert, October 21, 2026; UK National Cyber Security Centre; Reuters, “Websites taken offline over PHP risks,” October 21, 2026; The Register, October 21, 2026.
