A 22-year-old crack in the foundations
To understand why one bug could darken government websites on three continents, you need to know what PHP is and why so much depends on it. You also need to know that people had seen this kind of weakness three times before.
PHP is a programming language that runs on the web server, not on your phone or laptop. When you open a page, PHP fetches things from a database (your basket, a news article, a tax form), puts the page together, and sends it to your browser. Its mascot is a blue elephant, the "elePHPant".
It powers WordPress, Drupal, Joomla and MediaWiki (the software behind Wikipedia). It's also behind a huge number of council, ministry and university sites, which is why governments were hit so hard.
Think of the web as a city's restaurants. Your browser is the dining room. PHP is the kitchen at the back, cooking every page to order. PHP2Shell was a flaw in the standard kitchen design used by roughly 7 in 10 restaurants. It wasn't one bad chef. It was the floor plan itself.
That's why a page as simple as "Hello World" on an affected PHP version could be at risk. The problem was in PHP itself, not in any one website's code.5
Three warnings that came and went
The core idea behind PHP2Shell is simple: what happens when PHP runs out of memory halfway through a job? If it stops abruptly, it can leave half-finished work lying around, and later code may trust that mess. People had noticed this risk before.
On 14 July 2004, German researcher Stefan Esser (e-matters) published an advisory. He showed that a remote attacker could trigger PHP's memory_limit cut-off at an unsafe moment, leaving data half set up, and use that to run their own code. It was fixed in PHP 4.3.8 (CVE-2004-0594).25
Calif says Esser never published his exploit, and that this 2004 research was the starting clue for the 2026 hunt. Fittingly, Calif credits Esser with introducing them to the PHP Foundation's security engineer.4
PHP bug #78876 showed that very long variables in a file-upload form could push PHP out of memory and leave cleanup undone.20
PHP's first external security audit was carried out by Quarkslab, coordinated by OSTIF and paid for by Germany's Sovereign Tech Agency. While fixing one of its findings, a PHP core developer "found the first signs" of the out-of-memory problem.3
Three fixes were proposed. One broke old code, one created a new way to crash sites, and one needed changes to thousands of add-ons. Because the team decided by consensus, nothing was agreed for months.23
"We won't pretend otherwise: the delay was a structural failure."PHP Foundation, explaining why the 2024 finding was never fixed. It blamed "both the security team's decision process and its lack of resources."236
Mihail Kirov, now at Tolmo, was on the 2024 audit team. He says the audit ran for 57 days with five people, and that its report noted "due to the time constraints of the audit, automated fuzzing was not utilized". One page of the report was withheld with the note "details to be shared after fixes are applied; fixes are complex and in progress". It stayed that way for about two years.22 The Wall Street Journal summed it up: this class of bug "had been flagged decades earlier" but was considered too hard to exploit.18
Two kitchen accidents
You don't need to read code to follow this. Both flaws come from one habit. When PHP runs out of its memory allowance, it stops on the spot instead of tidying up. Half-finished work gets left behind, and later steps trust it as if it were complete.933
The order slip abandoned mid-sentence
Picture a waiter writing an order slip. The kitchen suddenly runs out of counter space and everyone drops what they're doing. The half-written slip stays on the spike, and later the kitchen reads it as a finished order. If a stranger can arrange for that to happen, the "order" the kitchen follows can be theirs. In computer terms, that means their code runs on the server.3
The PHP Foundation warned that on some common setups this could happen "before any application code runs". In other words, the website's own code never gets a chance to defend itself.3
The hotel key that still opens the room
IBM's Patrick Fussell put it best: "Think of a hotel room where you check out, but your key still works."19 After a crash, PHP keeps internal "keys" pointing at memory from a previous visitor's request. The next request handled by the same worker can walk into that room and find what was left behind, such as passwords, login tokens or keys. Programmers call this a use-after-free.3
From one request to a takeover, in four boxes
PHP rated both bugs 9.2 out of 10 (CVSS v4). The leak wrongly claimed 10.0. Wikipedia lists CVSS 3.x scores of 9.8 and 8.1.242
Why the name? "PHP" plus "shell", hacker slang for a command line on someone else's computer. Put together, it means "from a PHP web page to control of the whole server." Wiz Research coined it.51
Did a robot really find it?
PHP2Shell was billed as one of the first world-scale bugs found with frontier AI. The truth is more interesting: humans pointed the AI in the right direction, and the AI did the heavy lifting at a speed people couldn't match.
The relay race: four teams, overlapping discoveries
OpenAI launched Patch the Planet on 22 June 2026. It gives security teams access to its Codex Security tools and API credits so they can find and fix bugs in open-source software.91 On 30 July it invited the small red-team firm Calif to look at PHP.4
Researcher Ryan Austin worked with an "LLM companion" and a code-review agent, starting from Esser's 2004 clue. Calif says "no special harness or restricted-access models" were used, and adds: "No model is simply capable of unearthing 'all bugs' with simple prompts."4 OpenAI says the model was GPT-5.6 Sol.92
Wiz Research (Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz) started on 19 Aug. They confirmed takeovers of Drupal and then WordPress within two days, and reported on 24 Aug.5 They used their own tool, Atlas, together with Gemini 4 Argon and GPT-5.6 Sol. Gemini's contribution to building and checking the attack was "particularly significant".5
Wiz: "a single researcher completed in a week what previously would have taken a world-class team months of work".19
OpenAI's own team, credited as "OpenAI Codex Security (Amy Burnett)", reported more ways in.31 OpenAI said: "To our knowledge, frontier AI found these vulnerabilities before attackers did" and called the episode "the defender's window in action". It predicted that "similar findings [will] increase sharply in the coming months".92
On Friday 16 Oct, Chainguard was told only that "something was coming in PHP". That night, CEO Dan Lorenc says, the company found the bugs itself using a frontier model and a "basic prompt of 'find bad vulnerabilities in PHP'".7 This is perhaps the most alarming detail in the whole story: a vague hint plus AI was enough.
The debate: discovery, or very fast rediscovery?
- Wiz: "What AI changed was the ability to understand the weaknesses".19
- Google DeepMind's Raluca Ada Popa: Wiz "has shown why frontier AI is a game-changer for cyber defense."5
- Wiz co-founder Ami Luttwak called it "the most severe AI vulnerability that was ever found".18
- Tolmo's Kirov: "finding the flaw and proving what it is worth used to be the same expensive activity. They have come apart."22
- Nick Rogers (Dead Neurons): "Humans noticed the bug in 2004, 2019, and 2024." He adds that "every single piece of PHP2Shell was already sitting in the public training data" and that "unsteered AI models failed to connect the dots on their own."20
- SmartScope: "Public materials do not establish how autonomously Codex Security operated."21
- The WSJ noted that much of the risk assessment came from the companies involved.18
Eighty-one days, then seventy-two hours
The fix was prepared quietly over about 11 weeks. The secret then came apart in about three days. All times are UTC; for India add 5½ hours, for Japan add 9, and for central Europe add 2.
The race on 20–21 October, at a glance
OpenAI launches Patch the Planet
A programme to use AI to find and fix bugs in critical open-source code.91
First breakthrough
Calif finds its first unsafe out-of-memory stopping point. On 5 Aug Ryan Austin tweets a hash of the finding, a timestamped proof that reveals nothing.4
PHP gets the call
Calif reports an "unconditional RCE". The WSJ says Calif CEO Thai Duong phoned Volker Dusch of the PHP Foundation that day.318 Dusch's reaction: "Oh God, what are we doing now?"18
Proof shared, proof confirmed
Calif shares a working demonstration privately. PHP confirms it.46
Chainguard gets a hint and finds it in one night
One of the researchers told Chainguard "something was coming in PHP". Its AI found the bugs overnight.7
The ghost probe
Amazon's MadPot honeypot logs an exploitation attempt from a commercial anonymisation network. That was four days before the public was told. The Hacker News reports that the IP address traces to Australia; Amazon's own blog doesn't name a country.89 The same day, Chainguard starts working with the PHP maintainers.7
Rumours start
Lorenc: "And then on Monday, the rumors started, and yesterday it just spiraled."7
"Millions now"
Cloudflare CEO Matthew Prince posts the growth figures on X. Japanese banks, airlines and railways suspend some online services. VulnCheck has a working exploit for its paying customers by 01:30 ET.376595
The apology
petecooper posts "Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry" (745 points).27
Pranks and fakes on GitHub
JFrog warns about fake "exploits". One just swapped the victim's wallpaper for NSFW images.33 The Register publishes Chainguard's side of the story.7 In India, the Telangana TG-iPASS portal goes down at 11:36 pm IST in a separate ransomware incident (chapter 12).47
A third bug, and a government claim
CVE-2026-115560 is disclosed, with no emergency fix planned.102 A UK minister says 32 government services are unavailable and 4 partly unavailable.59 Unit 42 links an attack on a European government agency to PHP2Shell.32
The North Korea report
CYFIRMA publishes, and then updates, its advisory on a suspected North Korean scanning campaign.31
Retraction, and a bitcoin challenge won
Unit 42 withdraws its government-attack link.32 A public "Steal My Bitcoin" challenge on a deliberately unpatched server is won. The prize was worth about $2,021.83 TG-iPASS is reported restored, although reports conflict.49
Where things stand
CERT-In updates its India advisory.46 No confirmed public breach so far. Most governments are back online. The third bug is still waiting for a fix.
Four cracks in the dam
An embargo is like a surprise party. Everyone involved knows the date but keeps quiet so the guest (here, the attackers) doesn't find out first. PHP2Shell's party was spoiled in four separate ways within about 17 hours.
"source: trust me, bro"
At 15:20 UTC on 20 Oct, user petecooper posted "Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming". It said a reliable source had told him two critical PHP flaws would be announced on 22 Oct at 18:00 CEST. It claimed all versions from PHP 5 were affected, listed both CVE numbers, and urged people to be ready to update. The sourcing line read: "source: trust me, bro".26
Within minutes another user, unreal37, replied: "This was supposed to be embargoed."26 The post was later taken down, but screenshots had already spread.14
"I unknowingly broke the PHP RCE embargo. I am sorry"
Two days later petecooper posted a public apology. Its key lines:
- "I am truly sorry."
- "I take full responsibility for my actions."
- "It was not remotely my intention to cause any of the subsequent side effects."
- "I have learned my lesson."
He said his contact had told him there was no embargo.27 Some commenters, including Colin Percival (cperciva), argued that the embargo was already broken before the information reached him. Some guessed at who the source was; nothing has confirmed it.27
From rumour to fact
Once watchTowr confirmed the bugs were real, the rumour became news.15 A few hours later Calif "mistakenly published a video" showing its demonstration working "against numerous targets". The Foundation says: "The video contributed to accelerated development of various PoCs".3 Which platform it appeared on, and how long it stayed up, has not been reported. Huntress says only that it was "briefly posted online and then removed."14
Chainguard vs the PHP Foundation
The Foundation: "Chainguard unilaterally broke the embargo and published built images containing the fix… This disregarded weeks of work by many parties toward a coordinated disclosure." It added: "Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release."36
Dan Lorenc: "I made the call to get these out early when exploits hit in the wild." Also: "It's coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild." And: "I'm sorry that my decision led to even more stress for them."67
Who knew four days early?
Amazon's MadPot is a huge network of fake servers set up to attract and record attackers, a bit like a decoy house wired with cameras. On 17 Oct it caught an attempt to use PHP2Shell, before the leak and before Chainguard's release. Amazon CISO CJ Moses: "The exploit attempt originated from an IP address associated with a commercial anonymization network". He added: "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor." Amazon says "it remains unclear how the actor acquired exploit information prior to disclosure". An Amazon spokesperson said "there was no evidence" it was harmless.89
Moses's one-line lesson: "An embargo protects defenders only until someone else finds the same bug."8
How did attackers know? Why unplug to patch? Why could people still lose out?
These are the three questions readers ask most. Here are the answers, built only from what's been reported.
How did the hackers find out about a secret bug?
There was no single moment when "the hackers were told". Information reached them through five channels, roughly in this order:
The hint was enough
Once the world knew that PHP had two critical remote-takeover bugs, and roughly where to look, skilled people (and AI tools) could go hunting. Chainguard proved how quickly: given only "something was coming in PHP", it rediscovered the bugs in one night.7 OpenAI's Clint Gibler watched it happen: "a rumor/leak started Tuesday, and then immediately people everywhere began their own vuln hunting".16
The video helped
The Foundation says Calif's accidental video "contributed to accelerated development of various PoCs".3 It proved the attack was real, which is a strong motivator.
The fix itself is a map
This is the counter-intuitive part. Publishing a fix tells attackers what was broken. Comparing old and new code (a "patch diff") points straight at the weak spot. That's why the Foundation was angry that Chainguard's early builds let "any attacker… study the fix in binary form while every other PHP user was still waiting".3 Amazon: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit".8
The ghost remains a mystery
Nobody has explained the 17 Oct probe. It could be a leak from inside the large private group, or someone who found the bug independently. Amazon: "it remains unclear how the actor acquired exploit information prior to disclosure".8
If a patch existed, why did sites have to go offline to apply it?
A patch isn't a magic button. For a government running hundreds of sites, "applying it" means a chain of jobs, and attacks were already arriving while that chain was being worked through.
- Find every PHP site. Big organisations often don't know them all. The NCSC warned: do "not limit discovery to outdated PHP versions".39
- Get the right fix. Easy for PHP 8.2 to 8.5. For older versions there were only source-code patches, a volunteer's packages, or nothing at all.7497
- Test it. An upgrade can break an old council form or payment page.
- Deploy and restart every server, then check that the new version is really the one running.
A site that's switched off can't be attacked. So the safest order was: unplug → patch → check → plug back in. That's exactly what agencies advised. The NCSC said consider "taking the system offline until it can be fully mitigated"39, and KISA said "If even temporary measures are difficult, stop the service."64 Finland's Valtori shut off incoming traffic first and began installing patches around 18:00.53 Canada's minister: "Affected websites will be restored once patches are applied."42
If it was patched, why could some people still lose out?
First, the facts: as of 26 Oct there was no confirmed public breach through PHP2Shell. One claimed government case was retracted.32 But "patched" doesn't automatically mean "safe", and some losses were real. Here's why:
🚪 Burglars already inside
Patching changes the lock but doesn't remove someone who got in earlier. Attempts began on 17 Oct, before any patch existed. That's why the NCSC and Amazon say to check for backdoors going back to 17 Oct.398
🔑 Copied keys still work
One bug could leak server memory, including passwords and keys. If those were copied before the patch, they keep working until they're changed. Hence the advice to rotate secrets.9486
🔄 "Patched" but not really
The new version only protects you once PHP is fully restarted and the right configuration is in use. A half-done update leaves the old, vulnerable code running.30
🧓 Too old to patch
PHP 5.4 to 7.3 got no official fix. Bitsight found only about a third of the PHP versions it identified were covered by the update. Forgotten old servers stay exposed.7475
3️⃣ A third bug
CVE-2026-115560, disclosed on 23 Oct, affects even fully patched releases, and a fix is waiting for the next regular release.102
Two smaller, concrete "losses": the Steal My Bitcoin challenge, a deliberately unpatched server, lost its ~$2,021 prize on 25 Oct, which showed the attack can work against old code.83 And curious people who ran fake "exploits" from GitHub got pranked.33
The day governments unplugged themselves
The most unusual part of PHP2Shell is that the sites went dark because their owners switched them off, not because hackers knocked them down. It's like closing the shop and pulling down the shutters while a locksmith changes the locks.
The blackout board
🇪🇺 Europe
EUCERT-EU ADVISORY
Advisory 2026-018, 20 Oct: "patch affected assets immediately… Only an update fully fixes these vulnerabilities." If patching isn't possible, isolate internet-facing apps.40
NLNetherlands OFFLINE
On 21 Oct, Overheid.nl, MijnOverheid.nl and DigiD (the national login) went offline as a precaution. So did the parliament's site and NCSC-NL's own site, along with the Port of Rotterdam, the football association KNVB, the five largest parties' sites and many hospitals. NCSC: "There are currently no signals that the vulnerabilities are being actively exploited."5152 Prime Minister Rob Jetten said he was "closely monitoring the situation".19
FIFinland OFFLINE
Valtori, the state ICT centre, shut off incoming traffic. That took all government public web services offline. It said this was a precaution, not an attack. Patching began around 18:00 local time. Valtori "found no exploitation attempts".5352
FRFrance OFFLINE
"À la demande de l'Anssi" (at the request of ANSSI, the national cyber agency), the Interior Ministry put prefecture websites into preventive maintenance. Impots.gouv.fr, the CNIL (data regulator) and Météo-France also paused for a while. Orange blocked several subsidiaries' PHP sites.5463
DEGermany OFFLINE
BSI set warning level 3 / Orange and said disconnecting the web server from the internet until it is patched "may be considered". ITZBund took several federal sites down as a "purely preventive" step. Berlin's Charité hospital, the Berlin fire brigade, Uni Potsdam and mainz.de were also offline.5552
BEBelgium OFFLINE
The foreign ministry, Flemish government sites, e-ID, university hospitals (UZA, UZ Gent, UZ Leuven), the school platform Smartschool, broadcaster VRT and helplines' chat services all went offline. The CCB (the national cyber centre) said going offline was "a decision for each company or organisation itself" and knew of no incidents.56
DKDenmark OFFLINE
Kombit closed several services, including Aula, the national school communication platform. (The earlier short version wrongly placed Kombit in the Netherlands.)572
CZCzechia OFFLINE
NÚKIB told operators to update as soon as possible because exploitation instructions were public. Government sites were reported offline.2
AT · PLAustria & Poland ADVISORY
CERT.at: "every PHP installation that processes web requests is affected."104 CERT Polska warned that configuration changes only reduce the risk; only an update fully protects. Not found: Polish shutdowns. For Ireland, the other Nordic countries, Spain, Italy and Ukraine, no agency statements were found.
🇬🇧 United Kingdom
GBNCSC guidance PATCH OR UNPLUG
The flaw "may allow attackers to execute commands on any web server running PHP". "Organisations using any version of PHP are affected." Consider "taking the system offline until it can be fully mitigated", and check for backdoors even after patching.39
GBWhat went dark OFFLINE
A minister, Elizabeth Lloyd, told Parliament that 32 government services were unavailable and 4 partly unavailable.5919 The Edinburgh and Oxford council sites and the Metropolitan Police site were unavailable. Bristol, Lambeth and Barnet showed errors.58 The Office for Budget Responsibility went offline "in view of the critical security issues affecting PHP".
🌎 North America
USUnited States ADVISORY
- NSA: "all organizations using PHP for their systems are advised to be prepared for an update." It advised going offline if you can't update.672
- CISA: it had "not observed successful exploitation… as of the time of publication", and said to take systems on PHP 8.1 or older offline until patched.38
- FBI: the flaws could allow attackers "to remotely execute code in PHP core, potentially compromising sensitive data and networks".68
- KEV catalogue (CISA's list of known exploited bugs): no addition found as of 25 Oct. No federal sites were reported offline.103
CACanada OFFLINE
The Cyber Centre issued alert AL26-026: "Internet-facing PHP servers and applications are at heightened risk."41 Some Government of Canada sites went offline. Minister Evan Solomon said this was to "protect government systems and Canadians' information", and "Affected websites will be restored once patches are applied." Montreal's transit agency STM and the liquor board SAQ also went offline.42
🌏 Asia-Pacific
JPJapan OFFLINE
Prime Minister Sanae Takaichi posted on X: "Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight".19 The National Cybersecurity Office asked for action "as soon as possible".60
- Government: the Ministry of Finance, Japan Meteorological Agency and National Tax Agency restricted or suspended services.63
- Banks: MUFG, Mizuho, Nomura and Shizuoka Bank suspended some online services.6563
- Travel: ANA (airline) and JR East (railway) restricted some internet services.65
- Shops and companies: 7-Eleven Japan, Tokio Marine and Asahi paused some sites.6563
JPJapan's games 🎮 MAINTENANCE
Cygames put Umamusume, Granblue Fantasy and Shadowverse: Worlds Beyond into emergency maintenance from 23:00 JST on 21 Oct. Umamusume was back by 02:30.61 pixiv, BOOTH, Princess Connect! Re:Dive, Pokémon Champions and Another Eden were back by noon on 22 Oct. Bushiroad, SEGA, Square Enix, the Sony Store and Takara Tomy were still in maintenance at that point.62 Two long-running games announced they would shut down altogether, citing the issue.
KRSouth Korea ADVISORY
The Science Ministry (MSIT) and KISA issued an advisory on 21 Oct and guidelines on 22 Oct. The headline message: "If even temporary measures are difficult, stop the service." Operators were told to check logs from 20 Oct onward and report anything odd to the 118 hotline. The private-sector cyber alert level was raised. Not found: named Korean sites taken offline.6463
SGSingapore ADVISORY
CSA alert AL-2026-151: "Attackers can exploit multiple critical vulnerabilities in PHP to achieve unauthenticated remote code execution." It urged "immediate action, prioritising internet-facing systems." Not found: sites taken offline.43
🌐 The big websites
WWikipedia / Wikimedia
The Wikimedia Foundation "taken down a number of other systems as a precautionary measure" until they could be patched. Parts of Wikipedia were briefly unavailable.5266
IAInternet Archive
Briefly offline on 21 Oct.2
44chan & Something Awful
4chan went "temporarily read-only while we await an urgent PHP security update". Something Awful shut its forums. Pinboard and DeviantArt were also down.66
WPWordPress hosts
Automattic (WordPress.com and others) said its sites were already protected.87 WP Engine and Pantheon patched their whole platforms. cPanel and CloudLinux shipped fixes for older PHP versions.96
CFCloudflare, Fastly, Akamai
Cloudflare put emergency firewall rules in place for every customer, including free plans. Its CTO said: "We are seeing early attacks emerging and are updating mitigations as new vectors show up."1266
⚠Even the dark web
Underground forums Exploit.in and Dread had to patch their own PHP servers.76
Who's who: the cast of characters
The story has finders, fixers, an accidental leaker, a defiant CEO, a volunteer hero, and a ghost.
The finders
Phoned the PHP Foundation on 11 Aug. He worried about what would happen once patches were public:18
"Some dude on Twitter could take the patches and run AI against it and post some exploit script… All hell will break loose."
A well-known security researcher who drew the PHP2Shell poster and comic for Calif.4
The fixers
Release manager for PHP 8.5, and the person who took Calif's call.18
"It is the most severe security issue that PHP has faced in more than a decade."
The Foundation's only full-time employee, working alongside 14 mostly part-time contractors.70
"Given that reliance, it is clear that PHP is incredibly under-funded."
Wrote the most widely shared post correcting the rumours: the real score, which workaround helps which bug, and how big the fix was.24
Co-creator of Composer, PHP's package manager. He rejected Chainguard's reason for releasing early.6
"There were no confirmed exploits."
The catalysts & commentators
Posted the warning two days early. He says he didn't know about the embargo.27
"I take full responsibility for my actions."
Shipped fixes six hours early and defended the decision.7
"I think this is kind of the new normal."
Gave the clearest numbers on how fast attacks grew. To Reuters:37
"I think we're going to have a year or two where every week it feels like the sky is falling".
Revealed the 17 Oct ghost probe.8
"The time from patch to working exploit is shrinking for structural reasons".
A veteran of vulnerability disclosure.16
"This leads us to reconsider the risk reduction value of long coordinated vulnerability disclosure embargoes".
Probed Amazon's decoy servers through an anonymising network four days before disclosure. Still unidentified.8
In their own words
"But seriously: patch."
"We predicted this could happen, but it was pretty crazy to observe in real time."
"It seems a little bit more complicated than expected to exploit."
"The exploits being sprayed indiscriminately either don't work at all"
"Yet given how much of society depends on it, too little funding goes into maintaining it."
"We take this situation extremely seriously"
From a trickle to a flood
First, to be clear: the people who found PHP2Shell were the good guys. The "threat actors" are the people who rushed to use it once it leaked. Here's what reporting says about who they were and how fast they grew. It's kept at headline level on purpose.
Attack attempts on Cloudflare's network
How many servers were exposed?
One quiet early probe
A single attempt on Amazon's decoy servers, sent through a commercial anonymisation network. No actor has been named. It's the only sign that someone may have had inside knowledge (see chapter 09).8
CYFIRMA's "staging" campaign
Threat-intelligence firm CYFIRMA reported a suspected North Korean state-linked operation. It used 21 hijacked scanning servers and narrowed its list to 216 target hosts. Targets included government, banks, ports, aviation, manufacturing and trading platforms in the US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU.31
CYFIRMA gave moderate confidence to a link with the wider Lazarus ecosystem. That rests on language and working style, with no shared infrastructure or malware. Its words: "No launch date has been stated." Amazon made no nation-state attribution, and no government has confirmed one.3110
Many hands, mostly failing
Chainguard's decoys caught traffic from China and Russia.7 ELLIO saw senders on Chinese, Hong Kong, Indian and European hosting networks, carrying test web shells, a remote-access tool and a DDoS kit.13 Fastly counted about 250,000 requests from about 3,200 IPs by midday on 22 Oct. That figure includes defenders scanning their own systems.36 Pantheon blocked more than 60,000 suspicious requests on day one.9
Old gangs, new trick
Sophos saw operators of "Potassium", a variant of the Mirai botnet, try PHP2Shell. The attempt was blocked, and Sophos corrected an earlier report that it had succeeded.34 On GitHub, fake "exploits" appeared, including one that only changed the victim's wallpaper to NSFW images.33 Underground forum users mocked most public exploit code as "AI slop", posting: "PoC yes. RCE no."76
Every theory, put on trial
These ideas circulated on Hacker News, X, Mastodon and blogs. Each gets a verdict, the evidence on both sides, and a bar showing how well it holds up. The bars are our editorial judgement, not a measurement.
"Someone had inside knowledge before the leak"
"AI companies leaked it on purpose for hype"
"Chainguard broke the embargo to help its customers"
"The Calif video was a PR stunt"
"They knew in 2024 and ignored it"
"North Korea is behind the whole thing"
"It's a planted spy-agency backdoor"
"Much of the web is now permanently hackable"
"A European government was hacked through PHP2Shell"
One theory we looked for but couldn't find any source for: "the leak was a deliberate test". No outlet or forum post we could find makes or supports it.
The internet talks about the internet
Hacker News was the centre of gravity, since the leak itself happened there. Here are the biggest threads, the funniest moments, and the debates that kept coming up.
"If the rumors are true, it may be worse than Log4Shell."
"php2shell is not a log4shell moment"
"Just shut down our MediaWiki site temporarily out of an abundance of caution."
"I expect it will be the death of the C codebase"
"Whoever broke the embargo is a moron."
"The demo video has been going around Twitter today"
- Is disclosure broken? User JonKF argued that in 2026 a vague hint is enough for AI to rediscover a bug fast.26
- Who's to blame? Many said you can't blame someone for breaking an embargo they were never told about. Others said posting was unwise anyway.27
- Memory safety: a long-running debate about whether C code like PHP's engine should be moved to safer languages such as Rust.28
- Hype vs reality: security researcher Kevin Beaumont noted that most public GitHub exploits don't actually work, thanks to a standard memory-protection feature.77 Marcus Hutchins said he hadn't seen it working beyond a handful of versions.34
- YouTube: LiveOverflow's "The race to the first exploit // php2shell"; Better Stack's "A PHP Bug Just Took Websites Offline Worldwide"; Decipher's interview with Ben Harris; and a Japanese explainer from FindU Academy about the Prime Minister's appeal.
- Japan (Qiita): "Vulnerability response in the AI era seems likely to become a contest of speed." The writer also joked that engineers could now justify downtime to clients with "because Takaichi-san said so".82
- Underground forums: mocking of a $10,000 exploit-purchase offer, and complaints about "AI slop" exploits.76
- Reddit: our research tools were blocked from Reddit and search engines returned no indexed threads, so we can't quote Reddit reliably.
PHP2Shell vs Heartbleed vs Log4Shell
Every few years one bug in a piece of shared, free software everybody relies on shakes the whole internet. Wiz put PHP2Shell in that lineage: Heartbleed exposed fragile shared infrastructure, Log4Shell exposed hidden dependencies, and "PHP2Shell could mark a similar turning point for the AI era".5
| Heartbleed (2014) | Log4Shell (2021) | PHP2Shell (2026) | |
|---|---|---|---|
| What broke | OpenSSL, the padlock software behind HTTPS | Log4j, a Java logging library | The PHP engine itself |
| ID | CVE-2014-0160 | CVE-2021-44228 | CVE-2026-109618 / -109619 |
| Everyday analogy | A shop assistant who reads out more of the customer list than you asked for | A diary that obeys any instruction written in it | A kitchen that trusts half-written orders |
| Worst outcome | Secret data leaks from memory | Full takeover | Full takeover, or data leaks from memory |
| Severity | 7.5 (later CVSS 3 rating) | 10.0 | 9.2 (v4); leaked as 10.0 |
| Hard part for defenders | Replacing certificates and keys | Finding Log4j hidden inside other products | Old PHP versions with no official fix |
| Found by | Humans (Google, Codenomicon) | Human (Alibaba Cloud researcher) | Humans + AI (Calif, Wiz, OpenAI) |
| Funding lesson | OpenSSL ran on tiny donations | Volunteer maintainers | PHP Foundation: one full-time employee |
Heartbleed and Log4Shell facts are from Wikipedia.99100 PHP2Shell figures are from chapters 01 to 08.
About "50% of the way" to Log4j: "worse direct exploitation" but a "shorter tail".
A potential "Log4Shell-scale" event. With Log4j the challenge was finding the library. With PHP, forgotten systems will be found, but may have no fix.
Likened PHP2Shell to Heartbleed, calling it the most serious PHP security problem in over a decade.
Advisories, targets, and one unrelated ransomware attack
India didn't see the dramatic government shutdowns that Europe did, according to the reporting we found. But it was on attackers' target lists, CERT-In issued a critical note, and the same week brought a separate ransomware attack on a Telangana portal.
"Critical remote code execution vulnerabilities in PHP"
- Issued: 21 Oct 2026. Last updated: 26 Oct. Organiser.org dates it 22 Oct.46101
- Severity: Critical. Risk: High.
- What it says: "These vulnerabilities exist in PHP due to memory corruption and improper resource control. A remote attacker could exploit these vulnerabilities by sending a specially crafted request to the targeted system."
- Update: "Multiple reports confirm large scale exploitation in the wild, users are advised to patch urgently."46
CERT-In is India's national computer emergency response team, under MeitY. We found no separate MeitY or NIC statements and no named Indian victims. One outlet reported "no Indian victim names yet".105
Where India shows up in the threat data
- India was among the priority countries in CYFIRMA's suspected North Korean target set.31
- ELLIO saw some attack traffic coming from an Indian internet provider's network. That's common, because attackers rent or hijack servers everywhere.13
- India has a huge PHP footprint. Many state portals, universities and small businesses run WordPress and similar systems, so the "update your PHP" message applies widely.
Telangana's TG-iPASS portal hit by ransomware
TG-iPASS is Telangana's single-window portal for industrial approvals. At about 11:36 pm on 22 Oct, the database server (hosted by Cloud4C) stopped connecting. Officials found the database and related files encrypted and renamed with a ".vgb" ending.4847
The ransom note left only a contact email and a machine ID, and named no amount. The Telangana Cyber Security Bureau (TGCSB) registered a case under IT Act Sections 43 and 66, on a complaint from Joint Director of Industries Sanga Suresh. A senior official admitted the existing security measures were unsatisfactory.48
On 25 Oct, Andhra Jyothy reported the portal restored, with officials saying "the information is safe on the server". Director Nikhil Chakravarthy said security was being strengthened "to prevent such incidents from recurring". Telangana Today, updated 26 Oct, still described restoration as in progress.4947
Is it linked to PHP2Shell? No source makes that link. None of the reports mention PHP, and the affected server is described as running Microsoft SQL Server. It's mainly a coincidence of timing.4847 Also unrelated: on 16 Oct, CERT-In and others alerted SBI to customer data on the dark web (3,897 records containing personal data, out of about 3.75 lakh analysed). SBI said there was "no material impact on its core operations".50
Should I worry? What should I do?
FAQ for everyone
Is my personal data at risk?
Do I need to update my phone or computer?
Should I change my passwords?
Why did government websites disappear?
I got an email saying "urgent PHP security update, click here". Is it real?
Was AI used to attack me?
✅ Website owner checklist
A plain summary of the official guidance from the PHP Foundation, NCSC, CISA, Amazon and Cloudflare. Follow your host's and your national CERT's advice first.
- 1Find out which PHP you run. Check every site, including the forgotten ones. The NCSC says not to limit the search to outdated versions.39
- 2
- 3Restart PHP fully so the new version is actually running. Make sure you changed the configuration your web server really uses.30
- 4
- 5
- 6
- 7
- 8Ignore random exploit code on GitHub. Some of it is fake or malicious.33
What PHP2Shell tells us about the next ten years
The window is shrinking
Amazon: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit."8 Prince expects "a year or two where every week it feels like the sky is falling".37 Defenders now have to patch in hours, not weeks.
Billions on top, pennies underneath
The Foundation's 2025 contributions were $730,534 from 536 sponsors, fewer than the year before.71 The Guardian contrasted its small staff with the "billions" going into AI.2 The Sovereign Tech Agency, which paid for the 2024 audit, says "too little funding goes into maintaining it."69 The Foundation is now asking companies, hosts and governments for sponsorship, and has switched from consensus to majority voting on security decisions.3
The embargo debate
Art Manion (FIRST) says this "leads us to reconsider the risk reduction value of long coordinated vulnerability disclosure embargoes".16 InfoWorld called it a weakness in the whole system.72 The counter-argument: without the embargo there would have been no patch ready at all. The likely future is shorter embargoes, smaller circles and faster releases.
The C question
Both bugs are the kind of memory mistake that languages like Rust and Go are designed to prevent.24 Rewriting PHP's engine isn't realistic soon, but the case for safer languages in new core infrastructure got stronger.
Small models can do it too
An arXiv paper from July 2026 (HoF-Bench) found that a minimal AI analyser without frontier models rediscovered up to 65 of 95 AI-found CVEs. Its misses clustered in C infrastructure code like PHP's.88 AI bug-finding is spreading fast, to defenders and attackers alike.
"An embargo protects defenders only until someone else finds the same bug."CJ Moses, Amazon CISO8
Glossary
- PHP
- A programming language that builds web pages on the server. Its mascot is a blue elephant.
- PHP2Shell
- The nickname for CVE-2026-109618 and CVE-2026-109619, coined by Wiz.
- CVE
- "Common Vulnerabilities and Exposures": an official ID number for a known security bug.
- CVSS
- A severity score from 0 to 10. Anything 9.0 or above is "critical".
- RCE
- Remote Code Execution: getting someone else's computer to run your commands over the internet.
- Shell
- A command line. "Getting a shell" means getting control.
- Out-of-memory (OOM)
- When a program uses up its memory allowance. PHP's abrupt stop when this happened is the root of PHP2Shell.
- Use-after-free
- A program keeps using memory it has already handed back, like a hotel key that still works after you check out.
- Embargo
- A private period when finders and fixers keep a bug secret until the patch is ready.
- Coordinated disclosure
- The process of reporting a bug privately, fixing it, then announcing it to everyone at once.
- Zero-day
- A bug attackers can use before any fix exists.
- Proof of concept (PoC)
- A demonstration that an attack really works.
- Patch diff
- The before-and-after comparison of a fix. Attackers study it to work out what was broken.
- Honeypot
- A decoy server that attracts and records attackers, like Amazon's MadPot.
- WAF
- Web Application Firewall: a filter that blocks bad requests before they reach a website.
- Backdoor / web shell
- A hidden way back in that an attacker leaves behind.
- Botnet
- A network of hijacked machines controlled together. Mirai is a famous family.
- End-of-life (EOL)
- A software version that no longer gets official updates.
- Backport
- Taking a fix from a new version and applying it to an older one.
- CERT / CSIRT
- A national or organisational cyber emergency team, such as CERT-In, NCSC or CISA.
- Ransomware
- Malware that locks your files and demands contact or payment, as in the TG-iPASS case.
- Lazarus Group
- A hacking group widely linked to North Korea.
- Frontier model
- One of the most capable AI models available, such as GPT-5.6 Sol or Gemini 4 Argon.
- Memory-safe language
- A language like Rust or Go that prevents whole classes of memory bugs.
Sources
Research compiled on 26 October 2026 from news outlets, cybersecurity press, vendor research, official agency advisories, Wikipedia, Hacker News and YouTube. This is a fast-moving story. Where sources disagree (discovery dates, release time, Cloudflare's rule timing, severity scores), both versions are given in the text. A few pages (CNBC, Reuters, The Guardian, Dark Reading, the NSA press release) blocked direct access, so facts from them came through syndicated copies or other outlets' citations. Numbers in the text link here.
- PHP2Shell official site (Wiz / OpenAI / Calif)
- Wikipedia: PHP2Shell
- PHP Foundation: Today's PHP security release (postmortem)
- Calif: PHP2Shell write-up and timeline
- Wiz Research: PHP2Shell
- Socket: The PHP embargo dispute
- The Register: PHP blames Chainguard
- AWS Security Blog: exploitation prior to disclosure in MadPot
- The Hacker News: exploit attempt 4 days before disclosure
- The Hacker News: exploitation hits government / suspected DPRK
- The Hacker News: exploit attempts hit millions
- Cloudflare: WAF protection for PHP vulnerabilities
- ELLIO: What we observed
- Huntress: leaked critical PHP vulnerabilities
- watchTowr: PHP2Shell
- TechTarget: disclosure unravels after leaks
- TechTarget: 22M exposed servers
- Wall Street Journal (via To Vima): AI just found a bug…
- CNN (via KEYT): government websites and PHP flaw
- Dead Neurons: PHP2Shell explained
- SmartScope: Did AI really find it?
- Tolmo: Faster than anyone can fix them
- The Next Web: "structural failure"
- Alexandre Daubois: PHP2Shell rumours corrected
- Bugtraq 2004: Stefan Esser memory_limit advisory · Red Hat RHSA-2004:395
- Hacker News: "Tell HN: 2x PHP RCE CVEs…" (leak post)
- Hacker News: "I unknowingly broke the PHP RCE embargo"
- Hacker News: main security-advisory thread
- Hacker News: PR-stunt discussion
- Hacker News search: PHP2Shell (threads & comments)
- CYFIRMA: suspected DPRK campaign
- Palo Alto Unit 42 (incl. retraction)
- JFrog: all you need to know (fake PoCs)
- SecurityWeek: Mirai operators join attacks
- SecurityWeek: exploitation started days before patches
- Fastly: proactive protection
- OfficeChai: Cloudflare CEO on thousands → millions
- CISA alert, 21 Oct 2026
- UK NCSC: critical security issue affecting PHP
- CERT-EU advisory 2026-018
- Canadian Cyber Centre AL26-026
- CP24: Canadian apps and government websites go offline
- Singapore CSA alert AL-2026-151
- ACSC alert · Cyber Daily
- iTWire: cyber.gov.au pulled offline
- CERT-In vulnerability note CIVN-2026-0510
- Telangana Today: TG-iPASS disrupted
- The420.in: TG-iPASS ransomware
- Andhra Jyothy: TG-iPASS restored
- Insights on India: SBI data alert · The420.in
- Rijksoverheid (via Open Nieuwsbank): Dutch sites preventively offline
- Reuters factbox (via The Star): websites taken offline
- Yle: Finnish government services offline · Valtori update
- Selectra: France live coverage
- Tagesspiegel (dpa): BSI warning
- VRT NWS liveblog: Belgium
- DR: Aula / Kombit
- Insurance Business: UK councils & Met Police
- The Register: dozens of UK government services out
- ITmedia (Japan)
- Famitsu: Cygames emergency maintenance
- Denfaminicogamer: game and service status · Game*Spark
- Boannews (Korea): global response roundup
- Hankooki: MSIT/KISA guidance · Boannews
- The Next Web: millions of attempts, no confirmed breaches
- NBC News: critical PHP vulnerabilities
- Philadelphia Inquirer: NSA advice
- Cointelegraph: Cloudflare millions / FBI
- Sovereign Tech Agency: investment at scale
- Express Tribune: PHP Foundation under-funded · BigGo
- PHP Foundation: Impact & Transparency Report 2025
- InfoWorld: weakness in coordinated disclosure
- HackerNoon: NSA says patch or go offline
- Tenable FAQ
- Bitsight alert
- Flare: underground analysis
- Kevin Beaumont on Mastodon
- YouTube · LiveOverflow: The race to the first exploit
- YouTube · Better Stack: A PHP bug just took websites offline
- YouTube · Decipher: PHP2Shell and defenders (Ben Harris)
- YouTube · 中村祐太のFindUアカデミー (Japanese)
- Qiita (Japan): developer reaction
- Cryptoast: Steal My Bitcoin challenge won
- Bluewin: what it means for you
- Security Boulevard: your data and credentials
- GitGuardian: secrets rotation
- Automattic: your sites are protected
- arXiv 2607.27030: HoF-Bench
- W3Techs: PHP usage statistics
- Kathmandu Post: Nepali websites offline
- CSO Online: OpenAI's Patch the Planet
- PPC Land: OpenAI on GPT-5.6 Sol
- CrowdStrike blog
- Sansec research
- VulnCheck blog
- cPanel · CloudLinux
- Warp2Search: sury.org packages · IT-Connect
- Techrights (opinion)
- Wikipedia: Heartbleed
- Wikipedia: Log4Shell
- Organiser: CERT-In alert
- The Register: a third PHP2Shell bug
- CNBC: is your data at risk
- Trending Topics: CERT.at (Austria)
- Free Press Journal: which Indian websites are affected
- NPR: AI found the flaw, hackers found the leak (further reading)
- Fortune: AI tools discovered the PHP vulnerability (further reading)