Two flaws in the code behind about 69% of websites have drawn millions of attack attempts in two days.
PHP builds most web pages, and two critical PHP2Shell flaws have put the internet on alert. TF explains the language, the bugs and the fixes.
Attackers began probing on 17 Octoberr, four days before PHP released patches. Cloudflare reports millions of attempts.
What’s Happening & Why It Matters
What PHP Does
PHP runs on a web server and builds the page you see. WordPress, Drupal and Joomla all run on PHP. W3Techs data puts PHP on about 69% of websites. Almost half run a version without security updates.
Because PHP is the engine, a flaw in the engine reaches every site built on PHP. Clean website code gives no protection.
What the Flaws Do
Two bugs, CVE-2026-109618 and CVE-2026-109619, each carry a 9.2 severity score. Both are memory-safety errors in how PHP recovers from a failed request. When a request runs out of memory halfway through, PHP skips cleanup steps, and later steps trust half-built data.
An attacker can then run code on the server without logging in. Hundreds of empty file-upload fields can drain memory in a small request. PHP reuses worker processes, so damage can spill into the next visitor’s request.
How Fast the Attacks Grew
Amazon’s honeypot network caught an exploit attempt on 17 October 2026. Several proof-of-concept exploits followed on 21 October, about 12 hours ahead of patches. Cloudflare’s chief executive, Matthew Prince, said thousands of attempts arrived in the 10 hours before disclosure.
Counts rose to tens of thousands within 45 minutes of disclosure and hundreds of thousands within two hours. Millions followed by early 22 October. Attackers are changing payloads to slip past Cloudflare’s firewall, learning from blocked requests.
What Attackers Want
Most traffic is scanning. Researchers have confirmed no takeover so far, though VulnCheck describes a technique achieving code execution on x86-64 systems with recommended settings. Cisco Talos sees some clumsy payload delivery.
One campaign tried to install Potassium, a Mirai-derived botnet built for denial-of-service floods. Hacked sites have value, because trusted domains can host phishing pages or deliver malware.
What To Do
Patch the PHP software itself. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating WordPress or plugins does not help. Servers on 7.4, 8.0 and 8.1 should move to a supported branch or use a distribution backport.
Check logs back to 17 October, well before disclosure. Keep a web application firewall switched on during patching as a stopgap. Censys counts more than 34.4 million PHP services still assessed as vulnerable on 23 October.
My take: The risk is the long tail. Log4Shell showed patching drags on for years, and 48% of PHP sites run unsupported versions. Hosting providers hold the real power here, because small site owners seldom touch server software. I would press hosts to patch customers by default and publish their progress.
TF Summary: What’s Next
Scanning will stay heavy for weeks, and attackers will refine exploits as researchers publish detail. Hosts and distributions will ship fixes in stages. Owners of unsupported servers face the hardest choice.
MY FORECAST: Researchers will confirm the first mass compromises of unpatched PHP sites within weeks. Regulators and national cyber agencies will issue patch deadlines for public services by December 2026. Exposure will linger into 2027.
Related Stories
- PHP2Shell: AI-Assisted PHP Flaws Put Most Websites at Risk
- TF Cybercrime Round-Up: 6-11 October 2026
- OpenAI Models Hacked Test Crypto Wallet and Websites
- Google Cloud London Outage Disrupts Revolut and UK Banks
- OpenAI Internal Coding Agents Weakened Safety Monitoring