Full Breakdown
Global PHP Hypertext Preprocessor (PHP) Vulnerability Sparks Massive Exploit Attempts and Precautionary Website Shutdowns
By Drooid · · How we work
The Immediate Crisis
On October 21, 2026 developers disclosed two critical remote-code-execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619), dubbed “PHP2Shell.” The vulnerabilities affect the PHP runtime itself, allowing unauthenticated command execution. Within minutes of the announcement, cybersecurity firms reported a surge of exploitation attempts, prompting governments and private operators to pull websites offline while patches were applied.
Background & Context
PHP underpins roughly 70 % of all web sites, including WordPress, Drupal, Joomla and Magento. The flaws had existed for years but became exploitable after AI models generated a complex exploit chain. Researchers at Calif and Wiz reported the issues, and the PHP Foundation released emergency updates on October 21 after a leak of CVE identifiers and a proof-of-concept video.
Timeline
| Date | Event |
|---|---|
| Oct 17, 2026 | Amazon Threat Intelligence detected an early exploitation attempt targeting its MadPot honeypot. |
| Oct 20, 2026 | Planned public disclosure of the two CVEs; schedule advanced after the leak. |
| Oct 21, 2026 | PHP Foundation issued emergency patches; UK’s NCSC sent 50,000 alerts; 32 UK government services taken offline. |
| Oct 22, 2026 | Companies and governments rushed to apply patches; Cloudflare reported millions of exploit attempts. |
Data & Statistics
- Cloudflare observed “tens of thousands” of attempts within 45 minutes of disclosure, “hundreds of thousands” within two hours, and “millions now” overall — Matthew Prince, Cloudflare CEO.
- The UK cybersecurity minister said 32 government services were temporarily offline.
- Censys data indicated 1.5 million of 2.6 million identified hosts were running vulnerable PHP versions.
- Both flaws received a CVSS v4.0 severity rating of 9.2.
Official Statements & Responses
- The U.S. and UK National Cyber Security Centre issued urgent advisories urging immediate patching or temporary shutdowns.
- Japan’s Prime Minister Sanae Takaichi called for businesses to patch or shut down affected sites; the Finance Ministry suspended some online services.
- South Korea raised its private-sector alert level and activated emergency response measures.
- China’s Ministry of Industry and Information Technology demanded immediate inspection and upgrade to the latest PHP version.
On-the-Ground Reports
Precautionary shutdowns were reported across continents: the BBC’s “Traitors” site, Wikipedia, the Internet Archive and 4chan went dark in the UK; Japanese firms including Mitsubishi UFJ Financial Group, Nomura, ANA and East Japan Railway suspended internet services; France’s Orange temporarily blocked PHP-based sites; Finland’s state IT provider Valtori lifted blocks only after patches were installed. No confirmed breach of a production server has been publicly verified.
Conflicting Reports & Gaps
- Cloudflare and Amazon Threat Intelligence documented massive probing activity, yet the UK NCSC and Finland’s Valtori reported “no successful hacks.”
- Some sources noted “active exploitation attempts” on October 21, while others emphasized that shutdowns were precautionary, not reactive to an actual breach.
What’s Next
The PHP Foundation pledged to overhaul its security-decision process and increase staffing. Governments in Japan, South Korea and China have scheduled cybersecurity inspections for October 22 and beyond. Organizations are advised to upgrade to the patched PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) and verify that server-side runtimes are updated. Ongoing monitoring by cloud providers and national CERTs will determine whether the surge of attempts translates into successful compromises.