How much of the web PHP2Shell touches
PHP2Shell reaches most of the web because it lives in PHP itself, not in any one app. Sansec reports the vulnerable code dates to PHP 5.4 in 2012 and default configurations are exposed, so the risk is the language's entire footprint.
| Measure | Figure | Source |
|---|---|---|
| Websites with a known server language that run PHP | 70–80% | |
| Same measure, August 2026 | 70.2% (65.9% among the top 1 million sites) | |
| Websites running PHP | about 24 million | |
| Internet-exposed instances potentially vulnerable | more than 22.6 million | |
| Exposed hosts by Shodan search | about 1.9 million | |
| Exposed hosts, researcher estimate | more than 1.3 million | |
| Version-visible servers on unsupported PHP 5.4–8.1 | about 758,000 | |
| Version-visible servers on supported branches | about 272,000 |
The counts differ because they measure different things: sites versus servers, detectable versus all. The share figures cover only sites whose server language can be identified, so "70% of the web" is shorthand for that.
The viral X thread from developer fiveoutofnine put Censys's count at about 1.5 million servers on versions with no fix. It also listed Archive.org, Asana, GOG, Something Awful and the University of Vienna's webmail among the sites that went down.
The patch gap matters more than the headline share. Among servers showing their version, unsupported branches outnumber supported ones nearly three to one, and those branches get no official release.
The NSA warning is real, and the patches already shipped
The NSA warning is genuine. The agency followed its @NSACyber post with a formal release, NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities. It names the flaws PHP2Shell, places them in PHP itself rather than in any hosted app or its configuration, and warns they could let attackers take over web servers with no prior access.
The formal advisory goes further than the tweet:
- The NSA says it is prioritizing identifying malicious actors who may exploit the flaws
- It calls the risk serious enough to require immediate patching across U.S. government departments and agencies
- It tells organizations to inventory everything relying on vulnerable PHP versions, add logging, and replace end-of-life PHP that can't be patched
- It still advises taking systems offline if an immediate update isn't feasible
It wasn't a lone warning. The NSA, FBI and CISA jointly urged fixes for CVE-2026-109618 and CVE-2026-109619, which let attackers run commands on a server without logging in.
The update the NSA promised is out. PHP released fixes on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
How Cloudflare responded
Cloudflare moved before the public did. Cloudflare's php2shell post says it built WAF protections starting in early October and switched them on by default for free and paid customers at 3:02 a.m. UTC on October 21, about nine hours before disclosure. Free customers don't have to do anything.
Ordinary request filters weren't enough, Cloudflare says, so it built full transaction detection, a new WAF capability that checks a request and the server's response together. A response rule can replace a leaking response with a block page before it reaches the attacker, though it can't undo anything already done on the origin server. Cloudflare made the capability available to all customers, including Free plans.
PPC Land counts seven rules in the free ruleset, seven in the paid one, and one response rule. It also flags that the attack-traffic claims come from Cloudflare, which sells the product, and that a WAF only protects traffic passing through it.
Cloudflare's own advice matches everyone else's: patch PHP and keep the WAF on as an extra layer. Laravel agency Laramate went further, recommending Cloudflare's WAF as a stopgap while Laravel Forge was temporarily unavailable.
How the disclosure unraveled
A leak forced PHP to ship a day early. CyberScoop reports the project rushed an unscheduled release after details leaked and a major infrastructure company saw early attacks; both flaws score 9.2 on CVSS v4.0.
| Date (2026) | Event | Source |
|---|---|---|
| Oct 21, 13:34 UTC | Source fixes land in php-src on GitHub; patches roll out | |
| Oct 21 | NSA, NCSC, CERT-EU and agencies in Australia and Japan urge patching or takedowns | |
| Oct 21, 08:44 UTC | A WordPress host sees exploit attempts using a public proof of concept | |
| Oct 21, 03:02 UTC | Cloudflare's WAF rules go live for free and paid plans | |
| Oct 20–21 | Exploit video spreads via Kirill Firsov, credited to Calif and LCFR; watchTowr reproduces one flaw | |
| Oct 20 | CERT-EU advisory 2026-018 names both CVEs | |
| Oct 16 | White House says it first learned of the flaw | |
| Early August | A researcher first flags the issue |
The embargo cracked from another direction too. Dan Lorenc, CEO of supply-chain security firm Chainguard, wrote on LinkedIn (reposted on X) that his team was first read in last Friday by one of the original researchers. That same night, he says, they independently rediscovered the same issue using their own harness and a frontier model given the basic prompt "find bad vulnerabilities in PHP." They were fully read in Saturday, confirmed their findings matched the initial report, and helped test the fixes. Lorenc says he decided to ship Chainguard's fixed builds early and apologized to PHP's maintainers for the extra stress. When Labelbox security engineer Aaron Bacchi asked whether that prompt was really all it took, Lorenc replied: yes.
Does PHP2Shell affect all WordPress sites?
Yes, every WordPress site on an unpatched PHP is exposed, and updating WordPress does nothing. WordPress.org's security post says the flaws aren't WordPress-specific, hit any server hosting PHP, and no WordPress update is planned. Check your version under Tools > Site Health > Info > Server.
The exploit already works on current WordPress. Sansec reports Calif got unauthenticated code execution on WordPress 7.1.2, Drupal 11.4.3 and Joomla 6.1.4. William OGOU's breakdown adds that Wiz did the same against the official wordpress:latest container.
| Hosting situation | Exposure | Source |
|---|---|---|
| WordPress.com, VIP, WP Cloud, Pressable, Tumblr | Already protected, nothing to do | |
| SiteGround | Server-level protection, affected PHP features off | |
| WP Engine, Flywheel | CDN protection while PHP updates roll out | |
| Cloudways, DreamHost | Temporary protections, patched PHP pending | |
| Self-managed on mod_php | Highest risk: one request can trigger the attack before app code runs | |
| Self-managed on PHP 8.1 or older | No official release; minimal source backports for 7.4, 8.0, 8.1 |
This is the reverse of July's wp2shell scare, when WordPress force-pushed a core fix to every supported site. This time your host has to update PHP. Many are switching off session.upload_progress, which Roots creator Ben Word notes WordPress doesn't use. OGOU warns that toggle alone won't protect you.
Most prominent sites, apps and products affected
The scale figures are in the section on how much of the web PHP2Shell touches. These are the products running on that footprint:
| Product | Category | Why it matters |
|---|---|---|
| WordPress / WooCommerce | CMS and e-commerce | Largest PHP install base; exploit proven on 7.1.2 |
| Magento / Adobe Commerce, Shopware | E-commerce | Card checkout pages on exposed servers |
| Drupal, Joomla | CMS | Government and enterprise sites |
| MediaWiki | Wiki | Runs Wikipedia |
| Laravel, Symfony | Frameworks | Custom SaaS and internal apps |
| Roundcube | Webmail | Email access |
| Nextcloud | Self-hosted cloud storage | Private files |
| phpMyAdmin | Database admin | Direct database access |
| WHMCS | Hosting billing | Customer and payment records |
| phpBB | Forums | Long-tail community sites |
The list of apps with demonstrated exploits comes from Newsweek citing Sansec and Computer Weekly; the "why it matters" column is my read.
Organizations that pulled sites or acted, per Computer Weekly unless noted:
- Wikipedia/Wikimedia took down an unspecified number of systems
- Finland's Valtori took government public services offline
- The Netherlands' NCSC, Port of Rotterdam, Overheid.nl, the KNVB and several hospitals went dark
- France's Interior Ministry put all its sites in preventive maintenance
- Denmark's Kombit, Edinburgh Council, several BBC programme pages and DeviantArt went down
- Belgium's foreign ministry pulled its sites, and Japan's Prime Minister Takaichi urged PHP checks, per JFeed
- Laravel Cloud auto-patches customers, while Forge users update manually
A likely exception: Facebook. Meta runs Hack on its own HHVM engine, and HHVM dropped official PHP support after version 3.30. PHP2Shell targets the standard PHP engine, so Facebook is probably not exposed the same way. That's an inference; I found no Meta statement.
How the vulnerability works
PHP2Shell is two memory bugs in PHP's C core, both reachable with ordinary web requests and no login.
CVE-2026-109618: out-of-memory corruption. The attack runs in a straight line, per AlmaLinux and Exploitr:
- The attacker sends a crafted multipart upload, such as one with a huge number of part headers or empty file fields, staying inside normal upload limits.
- Parsing it pushes the request past PHP's per-request memory limit.
- PHP aborts mid-operation, leaving some request memory half set up.
- Cleanup treats the broken data as valid, which the attacker steers into code execution.
The same bug leaks server memory. JFrog calls it Heartbleed-style disclosure that needs only the factory-default session.upload_progress.enabled=On. Sansec notes the upload-progress handler runs before app code, so the leak works even if the app never starts a session.
CVE-2026-109619: stale state between requests. Sansec classes it as a fatal-error backtrace use-after-free plus OPcache type confusion. A fatal error interrupts native code before cleanup, then a later request or reused worker treats freed memory as live. PHP confirmed RCE against PHP-FPM through this bug.
Automattic's plain-English version: a request that fails partway frees memory PHP still points to, and a later request can reach it.
Interim mitigations, not substitutes for patching:
- Set memory_limit=-1 where apps can't override it, lower post_max_size, and enforce request limits at the proxy (SOCRadar)
- Put the site behind a WAF; Cloudflare deployed rules to all customers, including free accounts, calling them a stopgap
- If you don't accept uploads, block multipart requests and turn off file_uploads and session.upload_progress.enabled (Automattic)
How AI found it. CyberScoop reports a two-month collaboration among OpenAI, PHP maintainers, researchers and security vendors. Wiz used GPT-5.6 Sol, its Wiz Atlas tool and Google's Gemini 4 Argon. Google Cloud says Gemini helped with discovery, exploit development, detection and patch validation. Automattic credits Wiz Research, Calif, OpenAI and Quarkslab.
Is PHP a backdoor?
There is no evidence PHP2Shell is a planted backdoor, and the circumstantial evidence points the other way.
These look like ordinary C memory mistakes. Use-after-free bugs from error handling are C's classic failure mode. Researchers note memory-safety errors cause a large share of C security bugs, with Google estimating 70% of Chromium's came from them. Computer Weekly reports the flaws sat undetected for over a decade before Wiz and Calif found them with AI and coordinated with PHP. A planted backdoor wouldn't usually be found by commercial researchers and then amplified by the NSA itself.
PHP's one real backdoor attempt failed. In March 2021, attackers hacked PHP's own Git server and pushed two commits impersonating creator Rasmus Lerdorf and developer Nikita Popov. Maintainers caught it before any release shipped, and the project moved development to GitHub.
Why suspicion isn't crazy in general. The NSA has a documented record with Dual_EC_DRBG. Snowden-leaked memos indicated the agency became the standard's sole editor, and the Times concluded it held an NSA backdoor. Another document showed RSA received $10 million from the NSA.
What can't be ruled out: whether any intelligence agency privately knew about these bugs before August. Nobody can prove that negative, so "PHP was always a backdoor" stays a slogan, not a finding.
Are AI coding tools making frameworks obsolete?
It's a loud narrative with thin hard data, and mostly a frontend JavaScript story.
The case for it. The New Stack argues AI assistants now write boilerplate and native code, so "frameworks save time" no longer holds. Serenities AI claims 57% of companies run AI agents in production, but that measures agent adoption, not framework abandonment.
The case against. Cote, summarizing Brooks Lybrand, argues frameworks now act as guardrails that stop agents from improvising hacky, undocumented structure.
What usage says. W3Techs puts PHP at 70.2% of sites with a known server language as of August 2026, and W3Techs figures cited on LinkedIn show that share steady for a decade, with WordPress on about 40.8% of all sites.
My read: PHP2Shell cuts against the no-framework thesis on the backend. BrillMark's three-layer model shows why: the flaws live in the runtime, and the fix comes from your host, apt, Docker or Forge. Swapping Laravel for AI-generated bespoke PHP doesn't remove the runtime. It does remove the shared patch path that let WordPress fix wp2shell everywhere at once. The bigger AI story is that models found decade-old engine bugs in weeks, and Chainguard says a one-line prompt was enough to find them again.
Why PHP rose
PHP won by being easy to start, simple to embed in HTML, and cheap to host. Lerdorf has said he never meant to write a language and that PHP succeeded because it fit the early web. He told Linux Format he wanted a stripped-down C without C's memory-management burden. That design goal is the irony at the center of PHP2Shell: the C underneath still had memory bugs.
Cheap shared hosting sealed it. Mario Peshev notes the LAMP stack let hosts sell low-cost plans, and CMSes like WordPress, Joomla, Drupal, phpBB and MediaWiki followed. HackerNoon's Slogging debate on whether PHP is dead landed on the same point: WordPress and WooCommerce lock PHP in. An earlier HackerNoon thread recalled how much hiring once ran through PHP.
109 quotes on PHP2Shell, backdoors, PHP's rise and AI coding
Each quote runs under 15 words.
On PHP2Shell
- "These vulnerabilities often provide a direct path to the server's file system or database." — @NSACyber on X, original wording later revised in the formal NSA advisory
- "Where immediate remediation is not feasible, organisations should consider taking the system offline" — UK NCSC, via WordPress.org
- "consider isolating internet-facing applications from public networks until a fix can be applied" — CERT-EU, via Computer Weekly
- "That is the 'shell' in PHP2Shell: control of the server." — Automattic
- "seeing early attacks emerging" — Dane Knecht, Cloudflare CTO, via CyberScoop
- "CISA has not observed exploitation of these vulnerabilities as of the time of publication" — CISA, via Malware News
- "WordPress automatic updates will not apply this fix." — Alex Thomas, Wordfence, via The Repository
- Updating PHP "remains the most important step whatever we find" — Wordfence, via Nebula Design
- "These are extremely serious vulnerabilities affecting every PHP application on the web." — Laravel, via Securing Laravel
- "We have taken down a number of other systems as a precautionary measure" — Wikimedia spokesperson, via Newsweek
- "independent of the application running on top of it" — JFrog Security Research
- Stores "are exposed even when their own code is clean" — Sansec
- "PHP aborts it by jumping straight out of whatever it was doing" — Jonathan Wright, AlmaLinux
- "Setups using mod_php face the greatest danger." — Help Net Security
- "We've seen attempts to exploit this on our platform, and blocked them" — Wordify
- "Updating WordPress or your plugins won't fix it." — Meow Apps
- "the viral session.upload_progress.enabled=0 workaround will not save you" — William OGOU
- "The bug is in the PHP interpreter underneath them." — BrillMark
- "an operational risk note rather than a pricing event" — Newsquawk
- A WAF "should be treated as defense in depth, not as a confirmed solution" — AIIDE List
- PHP's advisory "confirms that both can be exploited without authentication" — SOCRadar
- "PHP2Shell is a flaw in the PHP runtime itself, not in any particular application." — Exploitr
- "We reserve the right to release earlier should details of either vulnerability become public" — PHP security team, via BleepingComputer
- "We consider the risk highest for mod_php" — PHP security team, via BleepingComputer
- "In the last hour, two remote code execution vulnerabilities in PHP have been leaked." — Benjamin Harris, watchTowr CEO, via TechRadar
- "the incredible security research team at calif.io" — watchTowr
- "this name does not come from the PHP Project" — SOC Prime
- "Thai Duong is one of the researchers behind POODLE" — on Calif's team, Roland Farkas
- "The Internet Is Burning" — headline, Gadget Review
- "PHP retaining request-specific state after its backing memory has been freed" — Huntress
- "PHP has confirmed neither claim." — on the leaked exploit banner, Equixly
- Leaked identifiers "came with an incorrect CVSS score of 10.0" — Tenable, citing the PHP Foundation
- "Suppressing messages through error_reporting, display_errors, or @ does not prevent the underlying access." — Qualys
- "The chain has been dubbed php2shell by researchers at Calif." — Tenable CVE entry
- "The change can break upload progress bars." — Vol.com.pl
- "PHP 8.2 reaches end of life on 31 December 2026." — Brandefense
- "PHP has released fixes for two flaws rated 9.2" — The Defiant
On the fallout and PHP's security history
- "Belgium's foreign ministry temporarily removed its websites" — JFeed
- "The speed of weaponization is what makes this disclosure significant." — on wp2shell, Expert Insights
- "Attackers are deploying persistent webshells on vulnerable servers." — on wp2shell, Wiz Research
- "Searchlight Cyber has withheld technical details of the exploit chain" — on wp2shell, CyberInsider
- "The Cal-CSIC recommends immediately upgrading to PHP to the newest version." — on 2024's CVE-2024-4577, Cal-CSIC
- PHP's dominance "making it a common target for webshells" — arXiv webshell study
On backdoors
- "everything points towards a compromise of the git.php.net server" — Nikita Popov, 2021, via The Register
- "This line executes PHP code from within the useragent HTTP header" — Jake Birchall, via The Hacker News
- "Cheers to the troll who put 'Zerodium' in today's PHP git compromised commits." — Chaouki Bekrar, Zerodium CEO, via HostArmada
- "there is no evidence to suggest that the malware was designed to be sold" — Security Affairs
- "it is always good idea to assume that some services might have been compromised" — LIFARS
- "We could have been more skeptical of NSA's intentions" — Sam Curry, RSA, via The Hacker News
- On Dual_EC, the NSA "put a backdoor inside the standard" — Graham Cluley
- "theoretically impossible for anyone but Dual_EC_DRBG's designers (NSA) to confirm" — Wikipedia
- "too obvious to trick anyone to use it" — Bruce Schneier, 2007, via RSA BSAFE wiki mirror
- "So was it a backdoor or not?" — Asecuritysite
- Memory bugs cause "a large proportion of security bugs in systems written in C" — arXiv CNnotator paper
On why PHP rose
- "I had no intention of writing a language." — Rasmus Lerdorf, via Computerworld
- PHP is about "how easy it is for people to get started" — Lerdorf, via PCWorld
- "At no point did I think I was writing a scripting language." — Lerdorf, via SitePoint
- "I didn't want all the memory management hassle of C" — Lerdorf, via TechRadar
- PHP 3 was "suitable for people with little or no programming experience" — PHP 3 announcement, via O'Reilly
- "PHP allows you to spin off a site in a few hours" — Mario Peshev
- "PHP is deeply embedded in WordPress, Facebook and many other web platforms" — The New Stack
- "To kill PHP they need to kill WordPress and Woo, that looks impossible." — Limarc Ambalina, HackerNoon Slogging
- "PHP was a golden goose for the Russian-speaking tech community" — Arthur Tkachenko, HackerNoon Slogging
- "By keeping this logic in PHP, Facebook is able to move fast" — HHVM wiki on GitHub
- "some of the most extraordinarily successful projects in history use it" — Keith Adams, via Post Status
- "PHP requests always start with empty heap, namespace" — Keith Adams, Taking PHP Seriously slides (the very guarantee CVE-2026-109619 breaks)
- "with enough thrust, even pigs can fly" — on PHP's critics, Strange Loop
- "PHP is horrible, but it's used everywhere." — Jeff Atwood, Coding Horror
- "PHP is rarely the bottleneck" — commenter, Coding Horror forum
- "The PHP source code for a 'hello world' page is literally 'hello world'." — Ilya Birman
- "PHP is opaque: no stack traces by default or for fatals" — SitePoint forum
On AI, frameworks and AI-written code
- "developers no longer need frameworks for productivity shortcuts" — The New Stack
- Without a framework, "an AI agent will implicitly generate its own bespoke, undocumented, and potentially unmaintainable version" — Cote, summarizing Brooks Lybrand
- AI is "sophisticated enough to handle the complexity that frameworks were designed to manage" — John D. Turner
- Agents "compress what would take a team into what one person can handle" — Vellum
- If AI is still just your copilot, "you're living in the past" — CoddyKit
- "Vibe coding turns developers into reviewers of applications they did not write." — HackerNoon
- "45% of all AI-generated code introduces security vulnerabilities" — Veracode research, via Security Boulevard
- Models copy insecure patterns, "which they reproduce with equal confidence" — Cycode
- "March 2026 alone had 35, more than all of 2025 combined." — on AI-attributed CVEs, Georgia Tech
- "AI-assisted commits expose secrets at more than twice the rate of human-only commits" — Cloud Security Alliance
- "In September, the repository itself became the exploit." — Adversa AI
- "A single prompt was enough to launch calc.exe" — Microsoft Security
- Better models and prompts help, but "they do not eliminate the underlying security risks" — arXiv vibe-coded apps study
More on PHP2Shell
- "Cyber actors are likely to weaponize PHP2Shell vulnerabilities." — NSA, formal NSA advisory
- "AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" — Wiz headline, via Techmeme
- "PHP2Shell Vulnerabilities Put 70% of Websites at Risk" — Adam Engst, TidBITS headline, via Techmeme
- "Two heap use-after-free primitives in PHP's 'session.upload_progress' handler" — researcher @j4ck3lsyn, via Techmeme
- Users should "prepare now so they can upgrade as soon as the release is available" — PHP, via SecurityWeek
- "We are now seeing php2shell exploited in the wild at scale." — researcher quoted by SecurityWeek
- "We expect mass attacks to start within 15 minutes of the release" — Sansec, via PC Gamer
- "The scale is huge." — Lukasz Olejnik, King's College London, to Reuters, via Safeguard
- "The name PHP2Shell comes from the leaked tool's own banner." — Secure in Seconds
- "A heavily secured custom system is just as vulnerable as a standard WordPress installation." — Techzine
- "ini settings won't save you." — Joe Ferguson, PHP 8.6 release manager, via The Hacker News
- "even a simple 'Hello World' page on a vulnerable PHP version can be attacked" — The Hacker News
- "Most of the internet is suddenly melting down, and there's only one fix" — headline, TheBlaze
- "no security researcher could have found and completed this exploit chain in 10 hours" — Adam Kues, Searchlight Cyber, on July's wp2shell, via Dark Reading
- Descriptions of 2021's Log4Shell "border on the apocalyptic" — The Washington Post, via Wikipedia
Cloudflare's response and the viral threads
- "so the NSA was like 'take your system offline'" — fiveoutofnine on X
- "Protecting against php2shell required more than standard request-based rules." — Cloudflare
- A common component's flaw "can put applications across the Internet at risk" — Cloudflare, on full transaction detection
- "The rules use request and response signals to stop exploit attempts" — Cloudflare on X
- "Cloudflare sells the WAF protection it describes" — PPC Land
- "php2shell is its first use in managed detections" — Technobezz
- "Use CloudFlare WAF, as it already provides protection against php2shell." — Laramate
- "Craziest day in cyber security in a long time" — Tobi Lütke, Shopify CEO, quoting Tony Ma's one-day tally of PHP, Node.js and NGINX CVEs, on X
- "I'm sorry that my decision led to even more stress for them." — Dan Lorenc, Chainguard CEO, on shipping fixed builds early, LinkedIn post reposted on X
- "'Find bad vulnerabilities in PHP' that's all it took?" — Aaron Bacchi, Labelbox, to which Lorenc replied "yes," same LinkedIn thread
What to do now
Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP worker. Computer Weekly's checklist covers the rest:
- Inventory every system running PHP, internet-facing first, at all versions
- Update to a fixed release and watch for follow-up advisories
- On PHP 8.1 or older, get a vendor backport or upgrade; 8.2 itself reaches end of life December 31, 2026
- Can't patch? Apply the temporary mitigations above or take the system offline
- Before upgrading an unpatched box, check for signs of compromise and backdoors
- Watch logs for odd multipart requests followed by memory-limit errors or bursts of HTTP 500s (Automattic, citing Wiz)
