By Aryamehr Fattahi | 23 October 2026
Summary
A pair of critical flaws in the PHP runtime, dubbed ‘PHP2Shell’, allow unauthenticated Remote Code Execution (RCE) and memory disclosure in versions back to PHP 5.4.0. A leak forced patches out a day early, on 21 October 2026, and prompted precautionary shutdowns in Europe, Japan and North America.
As of 23 October 2026, millions of exploitation attempts have not produced a publicly confirmed compromise. The lasting risk sits in end-of-life, embedded and shared-hosting systems that patch slowly.
Artificial intelligence (AI) has sped up exploit development, while PHP’s maintainers remain thinly resourced.
Publicly confirmed compromises attributable to PHP2Shell are likely within 3 months, mainly on unsupported and embedded systems. A sustained, multi-party funding settlement for PHP security is a realistic possibility by 2028.
Context
PHP is used by 70% of websites whose server-side language is known. Both flaws, patched on 21 October 2026, carry a Common Vulnerability Scoring System (CVSS) score of 9.2 and can give an attacker control of a server with a single request and no login. The affected code dates back to PHP 5.4.0, and one flaw lets attackers read live server memory holding passwords and Application Programming Interface (API) keys. As the bugs sit in PHP itself, updating websites or plugins does not help.
Calif, auditing PHP for OpenAI’s Patch the Planet programme, reported the first flaw on 11 August 2026, the same day OpenAI reported it independently. Wiz Research, which reported further attack paths on 24 August, described the exploit chain as “at the edge of what human researchers could practically achieve” until frontier AI models lowered the barrier. In 2024, a Foundation-contracted developer fixing issues from an audit funded by Germany’s Sovereign Tech Agency spotted warning signs but found no attack path. The PHP Foundation called the delay “a structural failure”, citing its decision process and lack of resources. Its few funded developers have also handled over 100 invalid reports since 1 July.
The embargo broke on 20 October, when a since-deleted Hacker News post named both Common Vulnerabilities and Exposures (CVE) identifiers and claimed a CVSS score of 10.0. watchTowr Chief Executive Officer Benjamin Harris confirmed the flaws were “indeed real” and also cited 10.0, against PHP’s official 9.2. PHP brought its release forward by a day. Calif accidentally posted, then removed, a proof-of-concept video, and Chainguard shipped patched images 6 hours early. Amazon had detected an exploitation attempt on 17 October, and now calls PHP2Shell “broadly exploited in the wild”.
Attempts run into the millions, yet officials in Germany, the Netherlands, the United Kingdom (UK) and Japan have seen no successful attacks. Germany’s Federal Office for Information Security (BSI) advised taking servers offline if in doubt, but BSI Vice-President Thomas Caspers later found the flaws “a little bit more complicated than expected to exploit”. Cloudflare deployed Web Application Firewall (WAF) rules, which filter malicious traffic, before disclosure, referring to them as “a STOPGAP only”. Cloudflare shares also rose about 6% on 21 October, after a 15% fall the previous week.
The US National Security Agency (NSA) advised taking systems offline if they could not be updated at once. Government sites went offline in Canada and across Europe. Japanese Prime Minister Sanae Takaichi urged overnight action, and banks including Mizuho halted some online services. About 758,000 of the 1.1 million hosts that disclose a PHP version run end-of-life branches. PHP 8.2 loses security support on 31 December 2026.
Implications
The gap between very wide exposure and so far unconfirmed damage shapes every aspect of PHP2Shell. The sections below examine where risk concentrates, why disclosure failed, how officials responded, what AI changes and who pays.
The Real Exposure Sits in the Long Tail
Supported deployments face a short window of risk, while unsupported and embedded systems face an open-ended one. Most hosts that disclose a version run branches with no official patched release. The 31 December cutoff adds to the problem, as PHP 8.2 sites patched this week will be unsupported again within 10 weeks. For hosting firms, an emergency patch becomes a forced migration, with costs for old plugins and bespoke code.
Headline exposure figures overstate the immediate risk but understate the lasting one. The common claim that PHP2Shell threatens 70% of the web treats every PHP site as exploitable, which current evidence does not support. Version counts also miss PHP built into firewalls, storage devices and control panels, which patch on vendor timelines. Palo Alto’s availability-only score suggests its devices face disruption more than data theft, which narrows but does not remove the problem.
Memory disclosure means quick patching may not end the damage. A patch does not revoke passwords or API keys already read from memory, and stolen credentials could be used months later with little trace back to PHP2Shell. That will complicate attribution, insurance claims and regulatory breach reporting.
Small businesses carry a risk they cannot manage directly. Updating WordPress, Drupal, Joomla or Magento does nothing, because the fix sits in a runtime the hosting provider controls. Shared-hosting customers rarely know whether their host has patched, so providers face reputational and contractual exposure.
The Collapse of Coordinated Disclosure
Coordinated disclosure failed through several small departures rather than one major breach. Chainguard’s early release had a defensible rationale in protecting customers, while Calif’s video was a simple mistake by a party inside the embargo. An embargo of about 2 months, spanning researchers, AI developers, vendors and edge providers, gave each of them a chance to break ranks.
AI-assisted research weakens the case for long embargoes. OpenAI and Calif found the same root cause on the same day, which shows how quickly well-resourced teams now converge on the same bug. The 17 October attempt suggests attackers may have done so too, or obtained details from inside the embargo. A single attempt of uncertain effect does not, however, prove an organised campaign before disclosure.
Severity inflation distorted early triage. A 10.0 score, backed by a respected security firm, framed the flaws as maximally severe before PHP’s 9.2 took hold, yet real-world exploitation has proved conditional. Security vendors gain commercially from alarm, although Cloudflare’s share rise followed a sharp fall and proves little on its own. Official agencies were also cautious: The BSI endorsed shutdowns before conceding the flaws were harder to exploit than expected. Observed outcomes have so far been a better guide to near-term risk than any single forecast.
Shutdowns, Proportionality and the Edge Providers
Taking services offline was defensible for high-value targets but costly as a general response. The loss of availability was certain, while the averted risk was uncertain. The absence of confirmed compromises invites the charge of overreaction. Yet operators had to decide before even the BSI judged exploitation harder than expected, and while attempts were climbing into the millions.
The response sets a precedent. A head of government urging overnight action and security agencies endorsing shutdowns make ‘going dark’ a mainstream option. A credible rumour of a critical flaw could now cause disruption without any exploit.
Edge providers have become first responders for shared infrastructure. Cloudflare protected customers before patches were public. A WAF, however, inspects only traffic routed through it, so servers reachable directly stay exposed, and Cloudflare’s own executive described the rules as temporary. Relying on a few US firms for emergency defence improves speed but deepens dependence, which sits uneasily with European ambitions for digital sovereignty.
AI Compresses the Path to Exploitation
AI mattered more for proving exploitability than for discovery. The root cause was spotted in 2024 without a credible attack path, and the new tools made a previously impractical chain achievable. The ‘AI-discovered’ label nonetheless obscures human judgement. Researchers chose PHP as a target and directed the work, and Wiz and OpenAI both benefit commercially from stressing what their models can do.
Attackers gain from the same compression, but reliable capability does not yet appear widespread. Amazon’s warning of broad exploitation rests on attempts of unconfirmed success, and millions of attempts with no confirmed compromise suggest much attacker code is unreliable. That gives defenders a window measured in weeks. Weaknesses previously set aside for lack of an exploit path, in PHP and other runtimes, now warrant a second look.
AI both adds to and eases the burden on maintainers. Over 100 invalid reports in under 4 months consume time that could go into fixes. AI-assisted triage helps, but the real constraint is the handful of engineers able to judge difficult trade-offs in PHP’s core.
Who Pays for the Web’s Foundations
PHP2Shell exposes a mismatch between commercial dependence and maintainer capacity. The 2024 finding stalled because the project lacked the people and decision process to act on it. Governments and banks that suspended services rely on a project run by a small funded team and volunteers.
More funding is likely, but its design will matter as much as its scale. The Sovereign Tech Agency audit showed that public money can find problems, while this case shows that finding without the capacity to fix leaves risk in place. AI developers funding discovery programmes such as Patch the Planet push more findings onto maintainers, adding to their burden unless money also reaches remediation. These firms also gain influence over who sets open-source security priorities.
Forecast
Short-term (Now - 3 months)
Compromises attributed to PHP2Shell and publicly confirmed by a victim organisation, vendor or national agency are likely, mainly on end-of-life and embedded systems.
A WAF bypass or new exploit variant prompting a further PHP security release is a realistic possibility.
Breaches using credentials stolen through memory disclosure are likely, though attribution will often remain unclear.
Medium-term (3 - 12 months)
It is likely that branches 8.1 and older still account for more than half of version-disclosing PHP hosts in October 2027, down from about 70% now.
New funding pledges to the PHP Foundation are likely, and multi-year commitments a realistic possibility. Confirmed compromises of public services would raise both.
Long-term (>1 year)
It is highly likely that another AI-assisted finding in a foundational open-source runtime prompts national cyber agencies in at least 2 G7 countries to advise patching or taking systems offline.
A sustained, multi-party funding settlement for PHP security is a realistic possibility.
A fall in PHP’s share of websites below 60% is highly unlikely.
