Key facts
- PHP released patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Exploit attempts climbed into the millions, according to Cloudflare's CEO.
- Germany and Japan have not confirmed any successful break-ins.
- The PHP Foundation cited a structural failure for the delay in fixing the flaws.
- Older PHP versions (8.1 and earlier) no longer receive official security updates.
PHP released critical patches on Wednesday, October 21, 2026, for two vulnerabilities, dubbed PHP2Shell, that allowed remote server takeover. The fixes are only effective once installed and the server restarted. While millions of exploit attempts have been recorded by companies like Cloudflare, major governments including Germany and Japan have not confirmed any successful breaches. Amazon's decoy servers logged an attempt as early as October 17, four days before the bugs were publicly disclosed. The PHP Foundation acknowledged that the delay in addressing one of the flaws, which it had identified signs of in 2024, was a structural failure due to decision-making processes and resource limitations. Older PHP versions, 8.1 and below, are no longer officially supported, leaving many servers vulnerable. Some websites, including Dutch hospitals and UK government services, were taken offline as a precautionary measure, with some returning online while others remained inaccessible.