A day after two serious PHP vulnerabilities triggered emergency shutdowns at government agencies, hospitals and major online services, patches are available—but protection depends on server owners installing them and restarting PHP.
According to Decrypt, the flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed PHP2Shell, could allow an unauthenticated attacker to take control of a vulnerable server. PHP is used behind the scenes by about 70% of websites for which the server-side programming language is known, making the incident significant even for people who have never knowingly used PHP.
For ordinary internet users, the immediate risk is generally tied to the websites they visit rather than to their phones or computers. However, a website that remains unpatched could potentially be altered or used to serve malicious content.
Patches are available, but installation is not automatic
PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. PHP said there were no complete workarounds and that updating was the only safe option. No additional patch had been issued as of October 22.
The release does not automatically secure every website. Hosting providers, corporate IT teams and individual website operators must install the appropriate version on their own systems. PHP must then be restarted before the fix takes effect.
Older installations present an additional concern. PHP 8.1 and earlier no longer receive official releases, although the PHP security team published limited patches for versions 7.4, 8.0 and 8.1 for users who compile the software themselves. Security company Mallory counted approximately 884,000 internet-facing hosts running PHP versions without an official fix.
The UK’s National Cyber Security Centre advised organizations that could not immediately mitigate the vulnerabilities to consider taking affected systems offline. That guidance contributed to a wave of temporary outages. Services reported as unavailable included Wikimedia services, Orange websites and apps in multiple countries, 32 UK government services, Dutch hospitals and Germany’s federal IT provider, ITZBund. The UK Office for Budget Responsibility and Edinburgh’s council website were back online by October 22, while the Dutch anonymous crime-reporting service Meld Misdaad Anoniem was still offline that morning, according to DutchNews.
Exploit attempts surged after disclosure
Attackers moved quickly. Cloudflare chief executive Matthew Prince said the company’s network recorded thousands of attempts during the 10 hours before the vulnerabilities were publicly announced. That rose to tens of thousands in the following 45 minutes, hundreds of thousands within two hours and millions afterward.
Amazon said its decoy systems recorded an attempted exploit on October 17, four days before public disclosure. Amazon chief information security officer CJ Moses said it was unclear how the actor obtained information about the exploit in advance, but described PHP2Shell as being broadly exploited in the wild.
Those attempts do not establish that attackers successfully entered the targeted systems. Germany’s federal cybersecurity agency, the BSI, said it had observed attacks but had not confirmed successful exploitation. BSI vice president Thomas Caspers said the vulnerabilities appeared somewhat more difficult to exploit than expected. Japan’s Chief Cabinet Secretary Minoru Kihara likewise said no attacks exploiting the flaws had been confirmed.
The distinction matters: an attempted intrusion can be detected even when access is unsuccessful, while a compromise may only become apparent later. Amazon has therefore urged defenders not to assume that October 21, the public disclosure date, was the first day of exploitation. Systems that ran a vulnerable PHP version from at least October 17 should be investigated as well as patched.
PHP Foundation calls delay a structural failure
The incident has also raised questions about how the vulnerabilities remained unresolved. The PHP Foundation said its security work in 2024 identified early signs of the out-of-memory problem associated with CVE-2026-109618.
According to the foundation, developers considered several possible solutions but struggled to choose among them and feared the consequences of releasing the wrong fix. It described the eventual delay as a “structural failure” caused by both the security team’s decision-making process and insufficient resources.
The foundation said its security process previously relied on consensus and will now use majority decisions. It also emphasized that security work on software used across much of the web still relies on a small group of foundation-funded developers and limited volunteer assistance.
For website operators, applying the patch is only the first step. Security firm Tag1 has advised checking for unfamiliar PHP files, newly created scheduled tasks and new user accounts. Operators of internet-facing servers that ran a vulnerable PHP version should also consider rotating database passwords and API keys.
What users and crypto holders should know
There is no confirmed data breach linked to PHP2Shell so far, so changing every password solely because of the incident is not supported by the information currently available. Standard precautions remain relevant: use unique passwords, enable two-factor authentication and respond promptly if a company later reports a breach. Reused passwords should be changed wherever they appear if an account is affected.
The vulnerabilities can also create risks for cryptocurrency users without affecting the underlying blockchain network. A compromised website could imitate a legitimate service and ask visitors to connect a wallet or approve a transaction. Binance founder Changpeng Zhao warned users to be especially careful when visiting websites in the days after disclosure. No crypto exchange had publicly reported a PHP2Shell-related breach as of October 22.
Users should verify what they are signing, use bookmarked sites instead of unfamiliar links and consider a hardware wallet if available. The key issue is whether the particular website has been secured, not whether a blockchain itself has failed.
Moneyiar market picture
Moneyiar data at 23:18–23:19 on October 22, 2026, showed the following prices and moves:
- Midnight (NIGHT): $0.0382742794, down 8.06% in 24 hours and 9.29% over seven days.
- Safe (SAFE): $0.101563015, down 6.99% in 24 hours and 13.60% over seven days.
- ONEchain (ONE): $0.1013802621, down 1.89% in 24 hours and 4.70% over seven days.
- Loaded Lions (LION): $0.0012291661, down 3.65% in 24 hours and 3.15% over seven days.
The PHP patches reduce the underlying server vulnerability only after installation and restart. Website owners still need to determine whether their systems were accessed before remediation, while users should remain alert for suspicious pages and unexpected transaction requests.
