PHP is trending because of a critical PHP vulnerability, CVE-2026-109618, and a second bug found alongside it, CVE-2026-109619. Together they're nicknamed "PHP2Shell", and they let an attacker who isn't logged in run code on a web server. PHP released emergency fixes on 21 October 2026, and security agencies told site owners to patch at once or take their sites offline. Many chose to go offline, which is why people are searching "websites down".
If you run a website on PHP, including any WordPress site, your fix is to get PHP on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a distro package with the patch included. Updating WordPress doesn't do this. If you only visit websites, you don't need to install anything. Details are below.
What is the PHP2Shell PHP vulnerability?
PHP is the programming language that runs on the server behind roughly 69% of websites, according to W3Techs. It powers WordPress, Drupal, Joomla, Magento and many hosting control panels. Censys counts about 55 million web properties running PHP. Palo Alto Networks' Cortex Xpanse estimates that more than 22.6 million exposed instances may be vulnerable.
Both bugs carry a CVSS v4.0 score of 9.2, which counts as critical.
- CVE-2026-109618: PHP can run out of memory while it's still setting up a request's data. When that happens, its cleanup code may treat the half-built data as valid. Attackers can abuse that confusion.
- CVE-2026-109619: This is a "use-after-free" bug. Memory from one request is freed but still referenced, so a later request on the same worker can reuse it. It can also leak memory contents.
The vulnerable code dates back to PHP 5.4.0, so it has been there for more than a decade.
Which PHP versions are affected and which are fixed?
PHP says every installation that serves web requests is affected. That covers PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php, because the attack can fire before any of your site's own code runs.
| PHP branch | Fixed version | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Official fix |
| 8.4 | 8.4.27 | Official fix |
| 8.3 | 8.3.36 | Official fix |
| 8.2 | 8.2.35 | Official fix. 8.2 reaches end of life on 31 Dec 2026 |
| 8.6 (pre-release) | 8.6.0 RC4 | Release candidate only |
| 7.4, 8.0, 8.1 | No official release | Only source-code backports exist |
| 5.4 to 7.3 | None | No fix at all, so upgrade |
Why are so many websites down?
Most of the outages were deliberate. Site owners shut down to stay safe, and in most cases the sites weren't hacked. CERT-EU and the UK's NCSC advised taking systems offline if you couldn't patch straight away. The US agency CISA said to patch immediately, and the NSA also issued a warning.
Sites reported offline or partly offline include:
- Finnish government services
- The Dutch parliament, the Dutch cybersecurity authority and the Dutch data protection regulator
- Canadian government websites
- Parts of Wikipedia, Pinboard, 4chan, Something Awful and the privacy group noyb
- Some Japanese daycare and video game systems
The timeline explains the rush. The CVE IDs leaked on 20 October through a Hacker News post that was later deleted. The leak carried an incorrect CVSS score of 10.0. PHP then moved its release up a day to 21 October, 14:00 UTC, and the patches went out at about 13:45 UTC. Amazon says it had already seen an exploit attempt on its honeypots on 17 October, four days before disclosure. It doesn't know how the attacker got the details.
There's also a dispute over the embargo. The PHP Foundation says the security company Chainguard shared patch details six hours before release, which helped attackers work backwards from the fix. Chainguard hadn't responded when NBC News asked about it.
Is PHP2Shell being exploited right now?
Sources disagree, and you should know both sides.
- Attempts are happening. watchTowr, Patchstack, Hadrian and Amazon all report exploit attempts, and Cloudflare's CTO mentioned "early attacks". watchTowr says many come from "vibecoded" (AI-written) exploits that send a
php2shellUser-Agent, and that none had succeeded when it published its report. - No confirmed compromises yet. CISA said it hadn't seen exploitation. As of the evening of 21 October, the CVEs weren't on its Known Exploited Vulnerabilities (KEV) list. Huntress saw nothing on its partners' systems as of 4:30pm ET on 21 October.
- Public exploit code is mostly junk. Dozens of proof-of-concepts are circulating, but few work, and the PHP Foundation found "no functional exploits" at release. Some of that code may itself be malware, so don't run random PoCs from GitHub or Telegram.
Researchers also disagree on how hard the bugs are to exploit. Red Hat thinks remote code execution is difficult on PHP-FPM, while Palo Alto's Unit 42 calls it reliable. Treat it as urgent either way.
Did AI find this bug?
Partly. PHP credited Calif.io (researcher LCFR), OpenAI and Wiz, among others. Calif and Wiz both say they used AI models in their research. OpenAI says it helped find the bugs through a program that gives security firms access to its models, and it called them "one of the most impactful security issues in recent memory." AI showed up on the attacking side too: watchTowr says many of the exploit attempts are AI-generated. For more on how AI agents are changing work, see our piece on Anthropic's Claude Duet AI agent in India.
How to check your PHP version
Pick whichever method suits your setup:
- On a server with SSH access: run
php -v. The command-line version can differ from the web version, so also checkphp-fpm -v(orphp-fpm8.3 -vand similar) if you use FPM. - From the browser: upload a file containing
<?php phpinfo();, open it once, note the version, then delete it straight away. Leaving it up exposes server details. - On shared hosting: look in cPanel under "MultiPHP Manager" or "Select PHP Version", or in your host's own panel, such as Hostinger's hPanel.
- In WordPress: go to Tools → Site Health → Info → Server.
Note for Linux distro users: Debian, Ubuntu, Red Hat and similar distros often backport security fixes without changing the main version number. Your package might still say 8.3.x and be patched. Check your distro's security advisory for CVE-2026-109618 to confirm.
PHP patch commands for VPS and dedicated servers
Use the commands that match your system, then restart PHP. Package names vary with your PHP version and repository.
Ubuntu / Debian
sudo apt update
sudo apt install --only-upgrade 'php*'
sudo systemctl restart php8.3-fpm # match your version
sudo systemctl restart apache2 # if using mod_php
# or: sudo systemctl restart nginxRHEL / AlmaLinux / Rocky
sudo dnf update 'php*'
sudo systemctl restart php-fpm
sudo systemctl restart httpdDocker
Pull the updated official image tag (for example, one based on 8.3.36 or 8.4.27), rebuild, and redeploy. Restarting an old container doesn't update anything.
After patching, confirm the version again and restart every PHP worker. Old workers keep running the vulnerable code until they're replaced.
Can't patch yet? Temporary mitigations
PHP says only updating fully fixes the problem. If you need time, these settings reduce the risk:
- For CVE-2026-109618: set
memory_limit=-1somewhere the application can't override it, such as the FPM pool config. Set a lowpost_max_size: 8M if your site has no uploads, 32M if it does. Limit memory with a container or cgroup limit, not RLIMIT_AS or RLIMIT_DATA. - For CVE-2026-109619: set
session.upload_progress.enabled=0inphp.inior the FPM pool. Setting it through.user.iniorini_set()won't work. On PHP 8.5, also setfatal_error_backtraces=0. - Restart all workers after you change anything.
- If you're behind Cloudflare, it has added WAF rules for these bugs. Those rules are extra protection, not a replacement for patching.
Signs of compromise to look for: PHP worker processes starting shells, calls to curl or wget from PHP, references to /dev/tcp, and requests with a php2shell User-Agent in your access logs.
I use WordPress. Does updating WordPress fix it?
No. WordPress is an application that runs on top of PHP. Updating WordPress core, themes or plugins doesn't change the PHP version on your server. Your host, or whoever manages your server, has to update PHP.
Wiz published demos of remote code execution against WordPress, Drupal and Joomla, so CMS sites are clearly in scope. Patchstack, a WordPress security firm, is among those seeing attack attempts.
What Indian hosting customers should do now
Most small businesses, bloggers and schools in India use shared hosting, where you can't run apt yourself. Do this instead:
- Check your PHP version in your hosting panel using the steps above.
- Raise a support ticket or start a live chat with your host. Ask: "Have you patched PHP on my server for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)? Which PHP build is my account running?"
- If you're on PHP 7.x or 8.1, switch to 8.3 or 8.4 in the panel if your site supports it. These branches have no official fix. Test on a staging copy first if you can, because older plugins can break.
- Back up your site (files and database) before changing anything.
- Change admin passwords once you've confirmed the patch, especially if your site handles payments or customer data.
- Watch for advisories from CERT-In, India's national cyber agency, at cert-in.org.in.
If your agency or freelancer built the site, ask them to confirm in writing that the server has been patched. Data exposure has real consequences, as recent cases like the SBI data leak on the dark web show.
Do ordinary visitors need to do anything?
No. PHP runs on web servers, not on your phone or laptop, so there's nothing to install on your own device. If a site you trust is down, it was most likely taken offline as a precaution and will come back after patching.
Stay alert, though. If a familiar site suddenly redirects you somewhere odd, pushes a download, or asks you to log in again in an unusual way, close the tab. If you lose money to an online scam, report it fast through the 1930 cyber fraud helpline.
The bottom line
PHP2Shell is serious because PHP runs most of the web, and the two bugs need no login to attack. Confirmed break-ins were still unreported as of 21 October, and most public exploits don't work yet, but attackers are actively trying. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro's fixed package), restart PHP, and get your host to confirm in writing. This story is moving quickly. Check back on the KyunTrend homepage for updates on exploitation status and CISA's KEV list.