PHP released security patches on October 21 for two critical vulnerabilities nicknamed PHP2Shell that allow unauthorized server takeover, prompting governments and organizations to take websites offline. The flaws affect PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which collectively power approximately 70% of websites whose server-side language is known. Cloudflare CEO Matthew Prince reported millions of exploitation attempts following the public disclosure, while Germany's BSI and Japan's government stated they had not confirmed any successful breaches. The PHP Foundation disclosed it identified the first signs of one vulnerability in 2024 but delayed fixing it due to decision-making challenges and limited resources.
PHP Releases Patches for Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35
PHP published versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday, according to its release notes. The organization stated: "There are no complete mitigations, updating is the only safe choice." As of Thursday, PHP has not issued any follow-up patch. PHP 8.1 and earlier versions no longer receive official releases, though PHP's security team posted patches for versions 7.4, 8.0, and 8.1 for users who compile the software themselves. The patches require manual installation by hosting companies, IT departments, and website owners, followed by a software restart for the fixes to take effect.
Cloudflare Records Millions of Exploitation Attempts
Cloudflare CEO Matthew Prince reported his network detected thousands of exploit attempts in the 10 hours before the public announcement. The attempts jumped to tens of thousands in the 45 minutes following the disclosure, hundreds of thousands within two hours, and millions subsequently. Amazon stated its decoy servers logged an exploitation attempt on October 17, four days before the vulnerabilities became public. Amazon CISO CJ Moses wrote: "It remains unclear how the actor acquired exploit information prior to disclosure," adding that PHP2Shell is "now being broadly exploited in the wild."
Germany and Japan Report No Confirmed Breaches
Thomas Caspers, vice president of Germany's federal cybersecurity agency BSI, said the agency observed attacks but no successful exploitation of the flaws, stating: "It seems a little bit more complicated than expected to exploit." Japan's Chief Cabinet Secretary, Minoru Kihara, also confirmed no attacks exploiting the flaws had been verified.
PHP Foundation Identifies 2024 Security Process Failures
The PHP Foundation published a blog post Wednesday stating its security work in 2024 "found the first signs of the OOM problem behind CVE-2026-109618," referring to the out-of-memory bug underlying one vulnerability. The team developed "several competing approaches" to address it but "struggled to choose between these and feared the repercussions of shipping the wrong choice," according to the foundation. The foundation wrote: "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources." The security team, which previously required consensus, will now decide by majority vote.
Organizations Take Websites Offline Following Disclosure
The UK's National Cyber Security Centre advised organizations to consider "taking the system offline until it can be fully mitigated." Websites taken offline on Wednesday included Wikimedia services, Orange websites and apps across dozens of countries, 32 UK government services, Dutch hospitals, and Germany's federal IT provider ITZBund, according to TechRadar. The UK's Office for Budget Responsibility and Edinburgh's council website returned online by Thursday. The Dutch anonymous crime-reporting site Meld Misdaad Anoniem remained offline Thursday morning, according to DutchNews.
Security Firms Recommend Server Audits and Credential Rotation
Security firm Tag1 advised administrators to examine PHP files not uploaded by authorized users, review new scheduled tasks and accounts, and rotate database passwords and API keys on internet-facing servers that ran vulnerable versions. Security company Mallory counted approximately 884,000 internet-facing hosts running PHP versions that no longer receive official fixes. Amazon advised defenders: "Defenders should not assume the public disclosure date is the earliest date of exploitation," recommending checks on any server running a vulnerable version since at least October 17.
FAQ
What versions of PHP received security patches on October 21?
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday to address the PHP2Shell vulnerabilities. PHP stated that updating is the only safe choice, with no complete mitigations available.
How many exploitation attempts did Cloudflare detect after the PHP2Shell disclosure?
Cloudflare CEO Matthew Prince reported thousands of attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after disclosure, hundreds of thousands within two hours, and millions subsequently.
Which organizations took their websites offline following the PHP vulnerability disclosure?
According to TechRadar, organizations that took websites offline on Wednesday included Wikimedia services, Orange websites across dozens of countries, 32 UK government services, Dutch hospitals, and Germany's federal IT provider ITZBund.
