AnswersPublished25 sources
PHP2Shell: What Happened and Which PHP Versions Were Patched
On October 21, PHP released fixes for two critical, unauthenticated remote code execution flaws; the next day, security reports described a sharp rise in exploit attempts. The fixed releases were PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- On October 21, PHP released fixes for two critical, unauthenticated remote code execution flaws; the next day, security reports described a sharp rise in exploit attempts.
- The fixed releases were PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators should check their PHP version and update to a fixed release appropriate for their branch.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What happened during the October 21–22, 2026 PHP2Shell security crisis, including PHP’s use by about 70% of websites; the unauthenticated re. Article summary: PHP2Shell prompted an emergency patching race on October 21, followed by reports of millions of exploitation attempts on October 22; its significance came from PHP’s reported use by roughly 70% of websites, not evidence . Topic tags: general, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clic
PHP2Shell was the name given to two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP released fixes on October 21, 2026, after details leaked ahead of a planned disclosure; by October 22, security firms were reporting a surge in attempted exploitation. PHP’s estimated use on about 70% of websites helps explain the urgency, but it does not mean that 70% of websites were compromised. 1
2
9
18
19
What the PHP2Shell flaws could do
The vulnerabilities were described as unauthenticated remote-code-execution (RCE) flaws: under affected conditions, an attacker could run code on a vulnerable server without first logging in. One flaw involved out-of-memory corruption; the other involved stale global state. 6
7
Reporting placed the affected range as far back as PHP 5.4. That broad potential exposure is not the same as proof that every PHP site was vulnerable in its configuration or successfully attacked. 14
21
The emergency fixes—and the early leak
PHP issued fixed releases on October 21: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 1
6 The fixes followed an October 20 leak, ahead of the planned October 22 disclosure. The early leak disrupted the coordinated timeline and was followed by an emergency patch release.
2
9
13
For organizations running PHP, the practical step is to identify the PHP version on each web-facing server and apply the fixed release for its branch. Security advisories also recommend checking installations that serve web requests, rather than assuming the issue is limited to a particular site or application. 7
11
AI-assisted research, with human teams in the loop
OpenAI said security firm Calif identified one flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the fixes and release. 48 OpenAI also said it had spent the preceding two months coordinating with maintainers, researchers and security providers.
48
The account is a case of AI being used in vulnerability research—not evidence that an AI system alone discovered, verified or fixed the flaws. The provided reporting describes research and coordination involving security firms and PHP maintainers as well as AI tools. 35
48
What was reported about exploitation and shutdowns
Cloudflare reported that attempted exploitation rose from thousands of attempts before public disclosure to millions afterward, while Amazon reportedly saw an attempted attack on October 17, four days before public disclosure. These are reports of attempts, not a count of successful compromises. 19
Security vendors also reported activity beyond honeypots, or decoy systems, while noting that official agencies had not confirmed those reports at the time. 17 Separately, reports described government websites and services being taken offline as a precaution, including more than 30 UK government services.
23 The NSA warned that attackers could use the flaws to take control of web servers, steal data, disrupt services or move deeper into networks; USA Today reported that the agency advised sites unable to fix the issue promptly to go offline.
18
23
The reporting supports a fast-moving security response and a high volume of attack traffic. It does not establish a worldwide tally of successful breaches. Nor should estimates of PHP’s share of websites be read as a measure of confirmed exposure or compromise.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "PHP2Shell: What Happened and Which PHP Versions Were Patched"?
On October 21, PHP released fixes for two critical, unauthenticated remote code execution flaws; the next day, security reports described a sharp rise in exploit attempts.
What are the key points to validate first?
On October 21, PHP released fixes for two critical, unauthenticated remote code execution flaws; the next day, security reports described a sharp rise in exploit attempts. The fixed releases were PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators should check their PHP version and update to a fixed release appropriate for their branch.