The PHP development team has released updates to fix two critical vulnerabilities nicknamed PHP2Shell, but the fixes only protect servers once they are installed and PHP is restarted. With exploit attempts reaching into the millions and hundreds of thousands of servers still running unsupported PHP versions, the internet remains a mixed picture.
The fix is out, but not universally applied
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday, according to its release notes. The PHP team stated that "there are no complete mitigations, updating is the only safe choice." As of Thursday, no follow-up patch had been issued.
However, PHP does not update itself. Every hosting company, IT department, and solo website owner must apply the update on their own servers and then restart the software for it to take effect. This means the fix is available but not necessarily active on the sites users visit.
PHP 8.1 and earlier no longer receive official releases, making older servers a weak spot. The PHP security team did post bare-bones patches for 7.4, 8.0, and 8.1 for those who compile the software themselves.
Attack attempts surge, but no confirmed breaches
Cloudflare CEO Matthew Prince reported a sharp increase in exploit attempts. In the 10 hours before the public announcement, Cloudflare's network saw thousands of attempts. That jumped to tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and millions since.
Amazon said its decoy servers logged an attempt on October 17, four days before the bugs went public. "It remains unclear how the actor acquired exploit information prior to disclosure," Amazon CISO CJ Moses wrote, adding that PHP2Shell is "now being broadly exploited in the wild."
Government agencies have not confirmed any successful break-ins. Thomas Caspers, vice president of Germany's federal cybersecurity agency BSI, said the agency had seen attacks but no successful exploitation, noting: "It seems a little bit more complicated than expected to exploit." Japan's Chief Cabinet Secretary, Minoru Kihara, also said no attacks exploiting the flaws had been confirmed.
An attempt is not the same as a breach, and break-ins are often discovered later rather than in real time.
Why the flaw wasn't fixed sooner
The PHP Foundation said its security work in 2024 "found the first signs of the OOM problem behind CVE-2026-109618," referring to the out-of-memory bug at the heart of one of the two flaws. The team developed "several competing approaches" but "struggled to choose between these and feared the repercussions of shipping the wrong choice."
"Without the Foundation's funding it would have been impossible to have multiple people work on this issue full time," the foundation added. It called the delay "a structural failure, caused by both the security team's decision process and its lack of resources." The security team, which previously required consensus, will now decide by majority. The foundation noted that security work for the software running most of the web "still depends on a small group of foundation-funded developers and a little volunteer help."
Some sites still offline
Patching takes time, and for those unable to patch immediately, going offline was the official advice. The UK's National Cyber Security Centre told organizations to consider "taking the system offline until it can be fully mitigated."
According to TechRadar, sites that went dark on Wednesday included Wikimedia services, Orange websites and apps across dozens of countries, 32 UK government services, Dutch hospitals, and Germany's federal IT provider, ITZBund. The UK's Office for Budget Responsibility and Edinburgh's council website were back by Thursday. Others, like the Dutch anonymous crime-reporting site Meld Misdaad Anoniem, were still offline Thursday morning, according to DutchNews.
What users should do
No confirmed data breach has been tied to PHP2Shell so far, so changing every password today is not necessary, especially if a site's server remains unpatched. Instead, security experts recommend unique passwords for every account, two-factor authentication, and paying attention to breach notifications in the coming weeks. If a breach is announced, change that password and any account where it was reused.
Website owners have more work: patching closes the door but doesn't reveal whether an attacker already entered. Security firm Tag1 advises looking for PHP files you didn't upload, new scheduled tasks, and new accounts, and rotating database passwords and API keys on any internet-facing server that ran a vulnerable version.
Crypto users urged to be cautious
Binance founder Changpeng Zhao advised on X: "Call me paranoid, but be extra careful visiting ANY web site in the next few days." A hacked web server can display a fake version of a real site, which in crypto often means a page that asks visitors to connect a wallet and approve a transaction that drains it. The blockchain itself may be secure, but the websites in front of it might not be.
For the next few days, double-check what you're signing, bookmark the sites you use instead of clicking links, and use a hardware wallet if you have one. So far, no crypto exchange has publicly reported a breach tied to PHP2Shell.
Overall risk remains for unpatched servers
Browsing the web today is about as safe as it was last week—not perfectly safe. The real exposure is on servers that haven't been patched. Security company Mallory counted roughly 884,000 internet-facing hosts running PHP versions that receive no official fix.
Amazon's advice to defenders is that the threat is ongoing. "Defenders should not assume the public disclosure date is the earliest date of exploitation." Any server that ran a vulnerable version since at least October 17 should be checked, not just patched.
