Is the Internet Safe Again After the PHP Nightmare? What You Need to Know
PHP has released emergency patches for critical vulnerabilities affecting 70% of websites, while attackers have launched millions of exploit attempts.
PHP released emergency versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday to address critical vulnerabilities nicknamed PHP2Shell. These flaws allow attackers to take control of vulnerable servers without logging in. The fixes only work once website owners install and restart PHP on their servers.
Cloudflare reported millions of exploit attempts since the vulnerabilities were announced, with activity escalating dramatically after public disclosure. In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now, said CEO Matthew Prince.
Attack Intensifies
Amazon revealed its decoy servers logged an exploit attempt on October 17, four days before the bugs went public. "It remains unclear how the actor acquired exploit information prior to disclosure," wrote Amazon CISO CJ Moses, noting PHP2Shell is "now being broadly exploited in the wild." Despite the widespread attempts, Germany's BSI and Japan's government reported no confirmed successful breaches yet.
It seems a little bit more complicated than expected to exploit.
Why the Delay?
The PHP Foundation acknowledged in a blog post that security work in 2024 "found the first signs of the OOM problem behind CVE-2026-109618." The team struggled to choose between competing fixes and feared repercussions of making the wrong choice. "The delay was a structural failure, caused by both the security team's decision process and its lack of resources," the foundation admitted, noting security work "still depends on a small group of foundation-funded developers."
Website Shutdowns
Numerous websites went offline as administrators took systems down before patching. Affected sites included Wikimedia services, Orange websites across dozens of countries, 32 UK government services, Dutch hospitals, and Germany's federal IT provider ITZBund. The UK's National Cyber Security Centre advised organizations to "consider taking the system offline until it can be fully mitigated." Some sites remained offline Thursday as patching continued.
User Precautions
Regular users don't need to change passwords immediately since no confirmed data breaches have been tied to PHP2Shell. However, security experts recommend using unique passwords, enabling two-factor authentication, and monitoring for breach notifications. Website owners should check for unauthorized PHP files, new scheduled tasks, and new accounts on vulnerable servers.
In the cryptocurrency space, Binance founder Changpeng Zhao warned: "Call me paranoid, but be extra careful visiting ANY web site in the next few days." Hacked web servers could display fake versions of legitimate sites, potentially tricking users into connecting wallets and approving transactions that drain funds. No crypto exchange has publicly reported a breach tied to PHP2Shell yet.
Related
