Last night, government websites around the world were hit by a major shock: the Dutch House of Representatives website was down, Finland’s National Land Survey could not be accessed, and the frontline service pages of French provinces and municipalities were blank. The official website of the Dutch National Security Centre NCSC, the Dutch government portal MijnOverheid, the Belgian Ministry of Foreign Affairs website, and the websites of the Edinburgh and Oxford city councils in the UK were all shut down at the same time; even the UK’s Doctor Who programme page could not be viewed, and even Japanese Prime Minister Sanae Takaichi speciallyPost on XWarn of its severity.
PHP2Shell Erupts: AI Helps Uncover a Shocking PHP Vulnerability Hidden for 20 Years
The reason for shutting down the websites was that a patch had not yet been released. The PHP language core has two unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a CVSS v4.0 score of 9.2, commonly known as PHP2Shell. The patched version was scheduled for release at 10 p.m. Taiwan time on October 21, but details of the vulnerabilities had already leaked on Hacker News the day before, and government agencies in various countries chose to shut down their sites outright during the few hours they waited for the patch.
Currently, PHP supports almost the entire internet. According to W3Techs, about 69.3% of known websites that use server-side languages use PHP, and WordPress, Drupal, Joomla, Laravel, and Magento all run on it. The vulnerability is in the PHP engine itself and has nothing to do with applications.
Two holes hidden for twenty years
The code for these two vulnerabilities can be traced back to PHP 5.4.0, which is 2012. Calif researcher Ryan Austin atOriginal disclosure documentIt is written very clearly there that these flaws have existed for decades, but “proving that they can be exploited requires an extremely complex chain of steps, approaching the limit of what human researchers can realistically achieve.”
The starting point goes back to 2004, when PHP core contributor Stefan Esser found the first “memory limit” remote vulnerability that year; at the time, he considered it serious enough not to disclose the exploit. In 2020, someone reported on PHP’s bug tracker that long variables could cause memory exhaustion and that temporary files were not cleaned up, bug #78876; the report was not taken seriously. In 2024, OSTIF and Quarkslab found it again while auditing PHP.
At the end of July 2026, OpenAI invited Calif to join the “Patch the Planet” program, with PHP listed as a high-impact target. On August 1, the Calif team got to work, and within a few days found the first critical memory exhaustion path, as well as three insertion points that could cause the program to be interrupted midway.
AI takes over the latter half.
On August 19, Wiz researcher Sagi Tzadik and colleagues used Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol. Find the first PHP vulnerability., reported to the PHP security team on August 24, ultimately resulting in two CVEs. In their technical analysis, they reached this judgment: “These findings rank among the most severe vulnerabilities in PHP’s history, and perhaps in software history as well. The underlying flaws have existed for decades, but proving exploitability required a complex chain approaching the limits of human capability; frontier AI has greatly lowered this threshold.”
AI did indeed do something, but what it did was not quite where outsiders imagined. Calif’s disclosure document mentions that after finding the first vulnerability, the research team gave the pattern “count first, then configure the key” to an LLM to abstract into a SKILL.md, whose content is a general structure: first publish or destroy state, then perform work that may fail, and only finally initialize or commit; if a fatal error occurs during the stage that may fail, commit and rollback are skipped, and surviving consumers will trust an incorrect state. It was this generalized pattern that led them to find the second vulnerability in session upload-progress.
Calif’s own account is more conservative. Describing the initial discovery, Ryan Austin said: “No special tools were used, nor any models that ordinary people can’t get access to. I focused on targets where I had background and knew the vulnerability history well.” His conclusion was that “know your target” still works today.
How was the vulnerability exploited?
PHP uses a hash table at the lower level to store request variables. Before allocating a new key, the code increments the counter, and only after the key allocation is complete does it actually initialize that slot. If a fatal memory exhaustion error occurs during key allocation, the counter for that slot has already been incremented, but the slot still contains uninitialized data. At request shutdown, the cleanup routine walks through these slots according to the counter and frees the data in them as valid objects. An attacker can prevent control flow from ever reaching the initialization lines while the counter has already been incremented, so during cleanup the residual memory is consumed as if it were live slots.
Calif found two ways to trigger memory exhaustion. One is to bypass post_max_size: PHP take Content-Length with post_max_size comparison, but the bytes actually consumed do not have the same upper limit, so Apache can send chunked HTTP/1.1 or HTTP/2 multipart requests without a declared length. Another exploits … in the RFC1867 upload format. filename="" the empty file part, PHP will not count it in max_file_uploads, yet it will still create a complete six $_FILES Field. Pairing. files[a][b][c] With nested field names like these, a few hundred empty upload records can consume the default 128 MiB PHP heap.[4]
The second vulnerability goes through session upload-progress. When PHP parses the request body, it opens the session early; at this point the module has not finished initializing, so the session’s global state retains a pointer to the request heap. If a fatal error occurs during parsing, the cleanup phase does not perform session finalization because the startup flag has not been flipped, but the heap is still freed. The Apache worker process survives, while the pointer points to memory that has already been freed. The second request carries the session ID and PHP_SESSION_UPLOAD_PROGRESS the field but not the file part; if it happens to skip the reset path, it will read that session ID that has already been released.
Attackers have an even broader path. PHP’s deserializer keeps a global list of references and destructors; when decoding is interrupted by memory exhaustion, the release of this list is skipped. After the request heap is reclaimed, the next request can cause the deserializer to reuse the reclaimed memory as a nested decoder. In the serialized data, R: and r: References can follow the list of references being reclaimed.
The attack surface is not limited to PHP itself. Calif’s testing confirmed that applications allowing unauthenticated code execution include WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Magento 2.4.9, Nextcloud 35.0.1, and Laravel 13.11. The vulnerability takes effect during request startup, so it can be exploited before the application’s own code even starts running; officials describe the highest risk as Apache’s mod_phpPHP-FPM and php-cgi are also affected.
There is no such thing as mitigation measures.
PHP core developer Gina Peter Banyard put it bluntly: “The only mitigation is to patch or upgrade PHP.” PHP 8.6 release manager Joe Ferguson added: “ini settings won’t save you.”
the UK NCSC’sSuggestionHarden: Organizations that cannot patch immediately should consider taking systems offline. CERT-EU It says“Consider isolating external-facing services from the public internet until a patch is available,” and noted that the scope of impact covers all versions after PHP 5. Japan’s IPA issued an advance warning before the release, and the NSA and CISA of Japan, Australia, and the United States also issued warnings simultaneously.
Cloudflare was the first to act. At 7:43 a.m. on October 21, CTO Dane Knecht said, “We’re seeing early attacks emerging and will update mitigations as new attack vectors appear,” and said Cloudflare had deployed its first batch of WAF rules about nine hours before public disclosure, covering even free-plan customers. But he stressed that this was only a stopgap and that patches needed to be deployed quickly.
The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and below are no longer officially supported, but the security team additionally provided minimal source-code backport patches for 7.4, 8.0, and 8.1. Sites using the community repository rpms.remirepo.net could not get the update that day and had to switch to distribution packages or compile it themselves. U.S. cybersecurity vendor Sansec warned in advance that “large-scale attacks are expected to begin within 15 minutes of release.”
How many machines are actually at risk?
The online claim that “more than 5.1 million PHP servers are exposed to the internet” has a basis in the number itself, but the wording is imprecise. VirusTotal Official blogThe release lists 5.1 million “IP addresses associated with PHP,” of which about 3.8 million have at least one open port and about 1.1 million disclose a PHP version. Of those 1.1 million, 272,000 are running still-supported branches 8.2 through 8.5, 758,000 are running end-of-life branches 5.4 through 8.1, another 88,000 are running 5.2 or 5.3, and 85,000 are running the latest version before the patch.
Researchers’ estimates fall into a different range. Security researcher Silas Cutler estimates that about 1.3 million internet-connected hosts may be affected, while Shodan search results show 1.9 million exposed PHP hosts. Kevin Beaumont said bluntly, “This PHP thing is going to cause a lot of incidents; it’s one of the biggest vulnerabilities in recent years.”
How do countries handle it?
The Dutch case is the most memorable, because even the National Security Center’s own official website went down. The House of Representatives’ Tweede Kamer, the Dutch Data Protection Authority, the MijnOverheid government portal, the Port of Rotterdam Authority, the Royal Dutch Football Association KNVB, and the websites of several political parties and hospitals were all unreachable.
Finland’s response was equally thorough. The national cybersecurity center Valtori shut down public services starting in the afternoon; some services of the National Land Survey, Helsinki Book Fair, Finnish Film Foundation, and Yle were affected, and Traficom’s cybersecurity center also issued a statement. Valtori’s explanation was clear: “This is a precautionary measure, not the result of an attack or data breach.”
France’s shutdowns were carried out by the Ministry of the Interior at ANSSI’s request and covered provincial and municipal websites, the tax authority, and weather forecasts; the Paris Police Prefecture website was also down. Belgium’s Ministry of Foreign Affairs website was shut down amid reports of attempted attacks, and Germany’s federal IT agency ITZBund also preventively shut down several of its websites.
In the UK, besides Edinburgh and Oxford city councils and the London Metropolitan Police, the Doctor Who and The Traitors show pages also went down, indicating that this wave of outages is not limited to government agencies. On the open-source community side, Pinboard, the Something Awful forums, and 4chan were restricted to read-only. In Japan, the parent-child communication app Codmon went completely down, and Nintendo-related services were also on the list. In South Korea, Kakao and Naver did not experience large-scale disruptions.
‼️ PHP UPDATE: The Dutch parliament, the Dutch national cyber agency and Finland’s central government have pulled websites offline ahead of the PHP patch. Finland’s state IT centre Valtori is shutting down public-facing central government web services. The National Land Survey of Finland is already down. In the Netherlands, the Tweede Kamer, the NCSC and the Dutch Data Protection Authority are offline. So are tech site Tweakers and NotuBiz, which runs council information for 100+ local governments. The University of Vienna switched off its websites, webmail and Moodle. The University of Freiburg and Finland’s Haaga-Helia have taken services down too. Fur Affinity, Pinboard, explain xkcd and every wiki on Miraheze are dark as well. Valtori says its shutdown is a precaution, not the result of an attack or breach. PHP was created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page PHP’s fix is due at 14:00 UTC today.
— International Cyber Digest (@IntCyberDigest) October 21, 2026
What will happen next?
October 21 is patch day and also a day for observation. CISA’s Known Exploited Vulnerabilities catalog has not yet listed these two IDs, and Tenable also warns that publicly circulating exploit code is unverified, with some of it bundled with malware. The PHP Foundation stressed that day that this is “one of the most impactful security issues in recent memory.”
OpenAI’s approach here is to bring defenders into the fold. The Daybreak for Frontline Defenders program launched on September 3 promises $1 billion in subsidized access over six months, prioritizing state and local governments, critical infrastructure operators, community banks, nonprofits, and open-source maintainers; the program has two tiers, Daybreak Blue and Daybreak Red, with Red providing a dedicated cyberattack model.
For the vast majority of website users, there is nothing to do; this is the responsibility of site operations. For site operations, the tasks are clear: find every host running PHP, including those no one remembers, upgrade them to a patched version, ask vendors for backported patches for those running versions before 8.1, and take the website offline if it cannot be patched that day. Hal Pomeranz, a computer forensics expert, warns: “There are far too many embedded installations out there that will never be patched, and far too many forgotten, unmaintained applications. This time there will be a very long tail.”
Source: KOCPC Chinese