PHP Security Crisis: Why Website Operators Are Racing to Patch Their Systems

Website owners spent this week doing something unusual for routine software maintenance: treating a PHP update as an emergency. On October 21, 2026, the PHP project released fixes for two critical flaws that can let an attacker run code on a web server without logging in. Several governments told operators to act the same day.

What happened

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are collectively nicknamed PHP2Shell. Each is rated 9.2 on the CVSS v4.0 scale. The first involves memory corruption when PHP runs out of memory handling a request. The second involves stale internal state that survives after the memory behind it was freed. PHP announced the release in an advance notice on October 20 and shipped the fixes at 14:00 UTC on October 21.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says all users should update immediately, and that updating is the only complete fix.

Because the bugs sit in PHP itself, not in WordPress, plugins or themes, updating those does not help. Affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Versions older than the fixed releases are affected unless a host or vendor has backported the fix.

Why it is a scramble

Scale is the issue. Roughly 70 percent of websites use PHP, according to a W3Techs figure cited by Cybersecurity Dive, though not every PHP site is exploitable because of differences in setup. Estimates of exposure vary widely: one researcher counted more than 1.3 million vulnerable sites, while Palo Alto Networks estimated more than 22.6 million exposed instances. These are estimates by different researchers using different methods.

Many operators cannot simply patch. Cisco estimated that roughly half of internet-facing PHP instances run versions too old to receive the fixes, so for them the real fix is a version upgrade.

Security researcher Kevin Beaumont said the situation "will lead to a mass of incidents" and called it "one of the biggest vulns in years." Researchers at Wiz, one of the firms that found the flaws, said they rank among the most severe discovered in PHP.

Government response

The U.S. Cybersecurity and Infrastructure Security Agency urged organizations to patch immediately. According to Cybersecurity Dive, agencies in the U.S., U.K., Canada, Australia and the European Union went further and urged website operators to take sites offline until they could be updated. The same report said the Finnish government and the Dutch House of Representatives disconnected some sites on Wednesday, citing Bloomberg reporting I could not check directly. The White House said the U.S. government learned about the flaws on October 16 and was coordinating with agencies and AI labs.

Is it being exploited?

Accounts differ. Security researcher Nicholas Weaver told Cybersecurity Dive there are "already reports of exploits in the wild." Threat intelligence firm watchTowr said it was seeing attempted exploitation in criminal communities, but its head of threat intelligence added that "nobody has been successful to date," and said he did not expect that to last. That mix of reports is worth keeping in mind: attempts are documented, while confirmed large-scale compromises are not yet established in the sources I reviewed.

The AI angle

One of the discoverers, security firm Calif, found the vulnerabilities using OpenAI's GPT-5.6 Sol model, according to Cybersecurity Dive. OpenAI said the case "highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits." Weaver put the practical lesson bluntly: AI is good at turning a patch into an exploit, so updates now have to be applied almost immediately.

What operators should do

• Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your operating system vendor's updated packages.
• Check with your host. SiteGround and InMotion Hosting said they applied the fixes across their servers, and Cloudflare said it added firewall rules to block exploit attempts. Those are protections, not replacements for updating where you control the server.
• If you cannot update yet, PHP and other researchers describe interim mitigations, such as disabling session upload progress (session.upload_progress.enabled = 0), which blocks one attack path for CVE-2026-109619, and turning off fatal_error_backtraces on PHP 8.5. These reduce risk but do not close the flaws.
• Test your exposure. Searchlight Cyber released an open-source scanner that checks whether a host is exposed.
• Retire end-of-life versions. If you run something older than the supported branches, plan an upgrade, not just a patch.

What to watch next

The key signals are confirmed compromises, how many servers remain unpatched, and whether governments ease their offline guidance as updates spread. This is a fast-moving story and the details above reflect reporting through October 23, 2026.