Sources
Last updated:
Every figure and quotation we publish, with the wording we use, its source and the date we last checked it. Where a figure is our own calculation, we show the method.
Corrections: hello@oakshield.co. We correct errors publicly and log the change below.
-
S-01What PHP2Shell is
PHP2Shell is the name security firm Wiz gave to two critical vulnerabilities in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619. PHP's security team rated both 9.2 out of 10 (CVSS v4.0). Under certain conditions, they can let an attacker who isn't logged in run code on an unpatched server.
-
S-02Fixed versions
PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
-
S-03No official fix for 8.1 and older
There is no official PHP release that fixes PHP2Shell on PHP 8.1 or older. The PHP team published minimal source patches for 7.4, 8.0 and 8.1, and none for 5.4–7.3. Sites on those versions depend on their host, their Linux distribution or a paid extended-support provider for a fix, or need to upgrade.
-
S-04What's affected
Nearly every PHP version back to 5.4 is affected, across the common ways PHP runs on a web server (PHP-FPM, Apache mod_php, CGI, FrankenPHP and LiteSpeed). Researchers rate Apache with mod_php as the highest-risk setup.
-
S-05Default configurations
Default PHP configurations are affected. One of the flaws involves a feature that is switched on by default, even if your site never uses it.
-
S-06Attack attempts at scale (WP Engine)
WP Engine reported that its firewall blocked more than one million requests tied to these vulnerabilities in 24 hours, with no successful exploit attempts.
-
S-07Status of confirmed compromises
As of 23 October 2026, security firms and governments reported widespread exploitation attempts but no publicly confirmed successful compromise, with one exception. Palo Alto Networks' Unit 42 reported a compromise at one European government entity, which hadn't been independently corroborated. This can change quickly. Check the date on this line.
-
S-08Found with help from AI
The flaws were found independently in August 2026 by AI red-team firm Calif, working in OpenAI's Patch the Planet program, and by Wiz Research. Both used AI models, and OpenAI's Codex Security team found additional elements.
-
S-09`php -v` can't prove you're patched
A version number can't prove whether PHP is patched. Many hosts and Linux distributions ship the fix as a backport that keeps the old version number. The command-line `php -v` may not even be the PHP that serves your website. And a patched package isn't actually running until PHP's worker processes are restarted.
-
S-10Firewalls help, but don't replace the patch
Web application firewalls can block many attack attempts and buy time, but security responders agree they don't replace the patch. Attackers changed their payloads to get past firewall rules within hours.
-
S-11Precautionary outages
Governments, banks and airlines took some online services offline as a precaution while they patched, including government sites in the Netherlands and Finland and services at Japanese banks, airlines and ministries.
-
S-12UK NCSC guidance
The UK's National Cyber Security Centre advised organisations to “Update to the latest version of PHP and continue to monitor for future updates.” For those unable to apply temporary mitigations quickly, it said “you should consider taking the system offline until it can be fully mitigated.”
-
S-13US NSA statement
NSA: “Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update.”
-
S-14CERT-EU
CERT-EU advised patching, isolating internet-facing PHP applications, or taking them offline if they can't be patched. On 23 October it noted that proofs of concept had started circulating.
-
S-15Japan: PHP advisories from national bodies
In Japan, the National Cybersecurity Office (NCO), IPA, JPCERT/CC, the Ministry of Internal Affairs and Communications, METI and the Ministry of Health, Labour and Welfare issued PHP2Shell advisories or requests on 21–23 October 2026. IPA advised cutting external access or suspending service where patching isn't possible. Neither IPA nor JPCERT/CC reported confirmed exploitation in Japan.
-
S-16Japan: coordinated breach-wave warnings
After a run of data breaches at Japanese companies, nine national bodies, including the National Cybersecurity Office, the National Police Agency, IPA and JPCERT/CC, issued coordinated warnings between 7 and 13 October 2026.
-
S-17Japan PM follow-up (22 Oct)
On 22 October, the Prime Minister met the head of the National Cybersecurity Office and then held a National Security Council meeting with ministers on the PHP issue.
-
S-18MIC: ordinary users don't need to act
Japan's Ministry of Internal Affairs and Communications made clear the request was for businesses that run websites. Ordinary internet users didn't need to do anything.
-
S-19JPCERT/CC: AI pentest platforms abused
On 23 October 2026, Japan's JPCERT/CC reported attack attempts that abused AI-based penetration-testing platforms.
-
S-20Japan: AI attack-simulation team
Japan's METI announced on 23 October 2026 that IPA will set up a team that uses AI to simulate cyberattacks, starting in November.
-
S-21Japan Active Cyber Defense law
Japan's Active Cyber Defense law took effect on 1 October 2026, including mandatory incident reporting for designated critical-infrastructure operators.
-
S-23Japan ransomware record
Japan's National Police Agency logged a record 123 ransomware cases in the first half of 2026.
-
S-24AI in Japan's breach wave: confirmed for some activity, extent disputed
Japan's JPCERT/CC confirmed that attackers in the October breach wave used AI, mainly to scan for known vulnerabilities and to attack through APIs, based on its analysis of three attacker servers (15 October). How much of the wave AI drove is still disputed. Experts told The Japan Times there was no firm evidence that AI guided the attacks overall.
-
S-02bCVE-2026-115560: not fixed by the 21 Oct releases
On 23 October, PHP disclosed a related flaw, CVE-2026-115560, that the 21 October releases do not fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (`session.upload_progress.enabled=0`) in the server configuration and restarting PHP. PHP says exploitation needs an unusual configuration and is unlikely.
-
S-30PHP's share of the web
PHP runs 69.3% of websites whose server-side language can be identified (W3Techs, 23 October 2026).
-
S-31Japan's PHP share
In Japan, PHP runs 83.5% of .jp websites whose server-side language can be identified (W3Techs, 23 October 2026).
-
S-32PHP 8.2 end of life
PHP 8.2 stops receiving security fixes on 31 December 2026.
-
S-33PHP 8.1 already end of life
PHP 8.1 stopped receiving security fixes on 31 December 2025. PHP 7.4 stopped in November 2022.
-
S-34Share of PHP sites on end-of-life PHP
By our calculation from W3Techs data (23 October 2026), about 48% of PHP websites that reveal their version run a PHP branch that no longer gets official security fixes. On 1 January 2027, when PHP 8.2 reaches end of life, that rises to about 66% unless those sites upgrade.
-
S-35WordPress sites on end-of-life PHP
WordPress.org's own statistics show that about a third of WordPress sites (34% as of 24 October 2026) run PHP older than 8.2, versions that no longer get official security fixes. Counting PHP 8.2, which reaches end of life on 31 December 2026, the figure is about 58%.
-
S-36The bottleneck is the hosting runtime, not WordPress
WordPress itself is mostly up to date: about 63% of sites run the latest major version, thanks to automatic updates. The PHP version underneath is set by the hosting environment, and that's where sites fall behind. WordPress auto-updates don't change it.
-
S-37WordPress's share of the web
WordPress runs 39.6% of all websites (W3Techs, 23 October 2026).
-
S-39Only about a third of version-identifiable PHP is on a branch that got the fix (Bitsight)
Bitsight's internet-wide scans found that only about a third of PHP instances with an identifiable version run a branch that received the October 21, 2026 PHP2Shell security update (PHP 8.2–8.5). PHP 7.4, which got no official fixed release, was the most common branch Bitsight detected.
-
S-40WordPress ecosystem speed (Patchstack)
According to Patchstack, a WordPress security vendor, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, up 42%. 46% didn't get a fix in time for public disclosure. For the most heavily exploited flaws, the median time to mass exploitation was 5 hours.
-
S-41Exploitation before the patch (Mandiant)
Google's Mandiant estimates that in 2025 the average time-to-exploit was minus seven days. On average, attackers were exploiting vulnerabilities before a fix was available.
-
S-42Exploitation is the top way in (Verizon)
Verizon's 2026 Data Breach Investigations Report found that exploiting vulnerabilities is now the number one way breaches start. Nearly a third (31%) of all breaches begin that way.
-
S-43Weaponization in under a day (Microsoft)
Microsoft's 2026 Digital Defense Report puts the median time from a vulnerability's discovery to working attacks at under 24 hours.
-
S-44Auto-updates work (Wiz on wp2shell)
When a critical WordPress core flaw (wp2shell) was published in July 2026, Wiz found that 25% of organizations using WordPress exposed a vulnerable site to the internet. Within 24 hours, thanks largely to automatic updates, that fell to 10%.
-
S-45Magento patches lag (SessionReaper)
Researchers at Sansec found that 62% of Magento stores were still vulnerable six weeks after the SessionReaper flaw was disclosed.
-
S-46Magento mass attacks (PolyShell)
In March 2026, attacks on a Magento flaw called PolyShell reached 56.7% of all vulnerable stores, according to Sansec.
-
S-47Other stacks aren't immune (React2Shell)
PHP isn't uniquely risky. In December 2025, a critical flaw in React Server Components and Next.js (React2Shell, CVE-2025-55182, rated 10.0) was exploited within days of disclosure, and a default Next.js production build was affected.
-
S-48Insurers are alerting policyholders (Coalition)
Cyber insurer Coalition alerted all its policyholders with internet-exposed PHP on 21 October. It told them to find every PHP system, update or get a vendor backport, and check for compromise.
-
S-04bLeaked secrets risk
Even without taking over a server, one of the flaws can leak memory from other visitors' requests, which may include passwords, session tokens and API keys.
-
S-50One attacker, AI agents, about $50 per break-in (Reuters)
In October 2026, Reuters reported that one attacker used AI agents to try to break into more than 1,200 websites and broke into sites belonging to more than 100 companies. The researcher who uncovered it estimated the attacker spent about $5,000 on AI model usage, roughly $50 per successful break-in.
-
S-51AI makes smaller targets worth attacking
Anthropic reported in September 2026 that AI is cutting attackers' labor costs while payoffs stay the same, which makes lower-value targets worth attacking.
-
S-52Old weaknesses, made cheap
In the cases Anthropic disrupted, attackers mostly got in through old weaknesses: unpatched websites and content-management systems, VPN and edge devices, and exposed secrets. They didn't use fundamentally new techniques.
-
S-53Cheap discovery (research demonstration)
In May 2026, researchers showed an AI pipeline could find more than 300 critical WordPress plugin vulnerabilities in 72 hours, at about $20 per vulnerability.
-
S-54Fully autonomous attack pipelines not yet seen
Google's Threat Intelligence Group said in September 2026 that it had not yet observed attackers deploying fully autonomous attack pipelines against targets in the wild. Anthropic reported the same month that attackers were still heavily involved in choosing targets.
-
S-55AI-found bugs aren't exploited more often
VulnCheck found that of 1,061 vulnerabilities discovered with AI help, 14 (1.3%) had been confirmed exploited in the wild in the first half of 2026. That's about the same rate as vulnerabilities overall. The shift is speed and volume against known flaws, not a flood of AI super-exploits.
-
S-56Storm-0940 / ARTEX
Microsoft reported in October 2026 that a China-aligned group, Storm-0940, used an agentic penetration-testing framework in a supply-chain campaign that reached sign-ins at more than 2,250 Microsoft cloud tenants. Microsoft noted most attempts failed and that an affected app being present doesn't prove data was accessed.
-
S-05bWho patches PHP: managed hosting vs your own server
Many shared and managed hosts reported patching PHP for customers on their managed plans. These include GoDaddy, Hostinger, SiteGround, WP Engine and WordPress.com, and in Japan Xserver, Sakura Internet and Lolipop. If you run your own VPS, cloud server or self-managed control panel, nobody patches PHP for you.
-
S-60Agents Rule of Two
We follow the 'Agents Rule of Two', published by Meta in October 2025: an AI agent should never combine untrusted input, access to sensitive systems or data, and the ability to change things or communicate externally, unless a human approves.
-
S-06bAttempts began before the patch (Amazon)
Amazon's threat intelligence team saw the first exploitation attempts on 17 October, four days before the patches were released.
-
S-06cPublic proof-of-concept circulating
Proof-of-concept exploit code has circulated publicly since about 21 October, though researchers say many published versions don't work.
-
S-06dInsurer honeypot spike (Coalition)
Cyber insurer Coalition reported 3,839 requests for PHP configuration pages on its honeypots in a single hour after the release, against about 100 normally.
-
S-10bGoing offline safely
If you have to take a site offline while you patch, use a maintenance page. Don't simply switch off PHP handling on the server, which can expose your site's source code to visitors.
-
S-10cCloudflare's default rules
Cloudflare says it switched on PHP2Shell firewall rules for all its plans, including Free, from 21 October. They only protect traffic that passes through Cloudflare, and Cloudflare notes some configurations aren't covered.
-
S-13bUS CISA
The US Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching. It advised organizations that can't update immediately, or that still run PHP 8.1 or earlier unsupported versions, to take PHP-based systems offline until they can be patched or updated. In its alert (published 21 October, last revised 23 October), CISA said it “has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication.”
-
S-32bHow long newer branches are supported
PHP 8.4 receives security fixes until 31 December 2028, and PHP 8.5 until 31 December 2029.
-
T-01Japan PM Sanae Takaichi's X post, 21 Oct 2026
On the evening of 21 October 2026, Japan's Prime Minister Sanae Takaichi posted on her X account what she called an "extremely urgent request". She asked website operators to check whether their public sites use PHP and to get ready to apply that night's fix as quickly as possible. For operators who couldn't patch quickly, she described temporarily taking a website offline as one effective way to reduce risk.
-
Q-01Quote: PHP Foundation (via Al Jazeera)
“Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing.” PHP Foundation (via Al Jazeera).
-
Q-02Quote: Gina Peter Banyard, PHP core developer (via The Hacker News)
“the only mitigation is patching/upgrading PHP.” Gina Peter Banyard, PHP core developer (via The Hacker News).
-
Q-03Quote: UK NCSC
“Update to the latest version of PHP." / "you should consider taking the system offline until it can be fully mitigated.” UK NCSC.
-
Q-04Quote: Kevin Riedl, Wavect (a consultancy that sells upgrades and migrations)
“Close the current exposure before making the emergency dependent on a full rebuild.” Kevin Riedl, Wavect (a consultancy that sells upgrades and migrations).
-
Q-05Quote: Ryosei Akazawa, Japan's METI minister (via Reuters)
“Defenders also need to make use of AI and respond proactively, staying one step ahead.” Ryosei Akazawa, Japan's METI minister (via Reuters).
-
Q-06Quote: Steven Yu, TrendAI (via Help Net Security)
“any motivated attacker with a credit card can execute this.” Steven Yu, TrendAI (via Help Net Security).
-
Q-07 -
Q-08Quote: Anthropic threat report
“treat AI keys and agent integrations with the same level of seriousness as they do production credentials” Anthropic threat report.
-
Q-09Quote: Amazon Threat Intelligence (via BleepingComputer)
“Defenders "should not assume the public disclosure date is the earliest date of exploitation."” Amazon Threat Intelligence (via BleepingComputer).
-
Q-10Quote: PHP Foundation
“did not identify any functional exploits at the time of release/public disclosure.” PHP Foundation.
-
Q-11Quote: PHP security advisory GHSA-6wmf-4rv5-p3rp
“absence of an error in logs is not proof of safety.” PHP security advisory GHSA-6wmf-4rv5-p3rp.
-
Q-12Quote: AlmaLinux
“Don't rely on `php -v`: our fixes are backported, so the upstream PHP version number doesn't change.” AlmaLinux.
Corrections log
No corrections yet. : page published.