High-Risk Security Flaw "PHP2Shell" Threatens Over a Million Web Servers
A major cybersecurity incident is unfolding across the internet. Security researchers and technology companies are warning about two severe security vulnerabilities collectively named PHP2Shell (tracked as CVE-2026-109618 and CVE-2026-109619). These flaws affect PHP, one of the most popular programming languages used to build and power websites around the world.
What Happened and How the Attack Unfolded
The PHP Foundation and its industry partners spent weeks urgently building, verifying, and testing security fixes before officially releasing patches on October 21. However, details about the flaws leaked online on October 20, causing sample hacker code to circulate rapidly.
Amazon reported that attackers were attempting to exploit the security weakness as early as October 17, using anonymous internet connections to hide their origin while the vulnerabilities were still supposed to be kept secret. Once the news became public, attack activity spiked drastically. Internet performance and security firm Cloudflare observed thousands of attack attempts in the hours leading up to the public announcement, which escalated to hundreds of thousands within two hours, and millions shortly after.
The Scope of the Risk
While many of the attack scripts currently circulating on platforms like GitHub and X (formerly Twitter) are poorly written and often fail or crash target servers, hackers are rapidly refining their methods. The broader issue is that millions of web servers remain unpatched. Security monitoring platforms like Censys, VulnCheck, and VirusTotal estimate that over one million web servers globally are running vulnerable software. A massive portion of these systems rely on outdated, "End-of-Life" PHP versions that no longer receive automatic security updates, leaving them exposed unless administrators step in manually. The vast majority of these vulnerable servers are hosted on major cloud services like Amazon Web Services, DigitalOcean, OVHcloud, Alibaba, and Hetzner.
How Experts Compare This Threat
Cybersecurity experts are comparing PHP2Shell to Log4Shell, one of the most widespread and severe web vulnerabilities in recent history. Marcus Hutchins, a principal threat researcher at Expel, estimates PHP2Shell is about half as disruptive as Log4Shell. While its direct impact is massive, PHP is generally less deeply embedded in background third-party software than Log4j was. Meanwhile, John Harbaugh, Chief Information Security Officer at BlueVoyant, highlighted that the main hurdle for organizations will not just be applying the fix, but locating forgotten web applications and unauthorized "shadow IT" servers that network owners may not even realize are running PHP.
Recommended Actions for Organizations
Cybersecurity authorities, including the U.S. Cybersecurity and Infrastructure Security Agency (CISA), urge system administrators to update immediately to patched PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Beyond applying emergency updates, organizations must audit their networks to identify every running instance of PHP, including legacy or forgotten applications. Security leaders also recommend putting strict access controls in place to restrict what a web server can access on the internal network. Limiting a web server to only the specific files and network services it needs to operate will help prevent hackers from using a compromised website as a stepping stone into the rest of the corporate network.
