The PHP flaw that made governments take sites offline — and what to do now

schedule What happened, day by day

1. ~17/OctAmazon detects the first exploitation attempt, four days before the public announcement.
2. 21/OctPHP releases the fixed versions. The PHP Foundation says a company published the patches hours before the agreed embargo ended.
3. 21–22/OctGovernments and companies take sites offline as a precaution. Cloudflare reports a sharp rise in exploitation attempts.
4. 23–26/OctTrail of Bits confirms exploits working against unpatched PHP 8.2 to 8.5.
5. 26/OctCISA adds both flaws to its catalogue of exploited vulnerabilities (KEV); US federal agencies have until 29/Oct to fix them.

translate What it is, without the jargon

PHP is the "language" that makes many sites work: it receives your request, fetches the data and builds the page. It runs inside the server, which is why a flaw in it is worth more than a flaw in a plugin: whoever exploits it takes control of the entire server.

These are two memory management flaws. In the first, when the server's memory runs out in the middle of a request, PHP clears data that was still half-finished and treats what is left as if it were valid. In the second, information left by a previous request points to memory that has already been freed, and the next request ends up using that "garbage". With enough skill, an attacker turns that slip into command execution, the so-called remote code execution (RCE). Hence the nickname: PHP + shell, the server's command line.

person_alert How this can affect your life

• Sites you use (store, bank, town hall, hospital, games) may go offline for hours or days while they are fixed.
• If a site's server is taken over, the attacker can read data held in memory and in the database. That is why system administrators should change passwords and keys, and you should change the password of any service that reports an incident.
• If you have a site, blog or store (WordPress and similar), it can be used for scams, spam, redirecting visitors or hiding malicious programs, and Google may flag it as dangerous.
• PHP also comes embedded in other products: TechCrunch cites components of routers, storage equipment, firewalls and VPNs. It is not always obvious that PHP is in there.
• Scammers exploit fear. Be wary of emails and messages saying your site or account has been hacked and asking for a password, payment or installing a program.

shield Who is at risk

The oldest flaw the researchers found dates back to PHP 5.4. Here is the situation by version:

• PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36, 8.2 before 8.2.35: vulnerable. Fix by updating to these versions or newer.
• PHP 7.4 to 8.1: no official fix version, only backports from some vendors. Ask your hosting provider or migrate.
• PHP 5.4 to 7.3: end of life, no PHP fix. Migrate.
• Ubuntu, Debian, CloudLinux and cPanel tend to keep the old number and fix it "internally" in the package, so check the vendor's advisory and not just the version number.

checklist What to do now: if you have a site

1. Find out which PHP version serves your site: in the hosting panel (in cPanel, "Select PHP Version") or ask support. Be careful: the php -v command shows the command-line PHP, which may differ from the one serving the site.
2. Update to a fixed version (8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer) or install your vendor's fixed package.
3. Restart the PHP processes. Installing the package does not fix a process that is already running.
4. Do not rely on temporary settings: they reduce risk but do not make the installation secure.
5. On PHP 8.1 or earlier without support? Migrate to a supported version (preferably 8.4 or 8.5). If that is not possible now, consider taking the site offline or putting it into maintenance until it is resolved.
6. Look for signs of intrusion, especially since 17/Oct: new and strange files, PHP processes spawning commands or downloading programs, abnormal traffic. If you find anything, do not delete it: preserve the evidence and call a specialist.
7. Change the server's passwords and keys (database, email, APIs). If you use UpdraftCentral on WordPress, delete its keys: Patchstack reports attackers using valid keys to install backdoors.
8. An application firewall (WAF), such as Cloudflare's, is a stopgap, not the solution: it only protects traffic that passes through it.

person What if I only use the internet?

• Use different passwords for each service and turn on two-step verification.
• If a store or service reports an incident, change your password and keep an eye on your transactions.
• Keep your phone and computer up to date and do not install anything from a "security" email.

hub It is not just PHP: what this shows

This is not the first time a hidden piece underneath everything threatens half the world. Heartbleed (2014) was in OpenSSL, which protects secure connections. Log4Shell (2021) was in Log4j, a Java logging library used in millions of systems. In 2024, a backdoor was planted in XZ Utils, a compression utility present on many Linux servers, and was only discovered by chance.

The pattern repeats: components nobody sees, old software that is hard to update and memory flaws in languages that do not protect the programmer from this kind of error. TechCrunch notes that the migration to safer languages is advancing but is incomplete, and that researchers say AI tools speed up the discovery of flaws; Calif and Wiz, which found these, used AI in the work. No technology is immune.

What helps in any case: knowing what you run (server system, WordPress and plugins, libraries, containers, even the router), having someone who follows the alerts and updating fast.

menu_book Glossary

RCE (remote code execution)

When an attacker manages to make the server run commands remotely.

CVE

Public catalogue number for a security flaw. Here, CVE-2026-109618 and CVE-2026-109619.

CVSS

Severity score from 0 to 10. Above 9 is critical; these score 9.2.

Patch

The vendor's fix that repairs the flaw.

mod_php / PHP-FPM

Ways for the web server to run PHP. PHP considers Apache's mod_php the highest risk.

Use-after-free

An error in which the program uses memory that has already been returned to the system, which attackers can exploit.

Exploit

Code or technique that takes advantage of a flaw.

KEV

CISA's catalogue of flaws that are already being exploited in practice.

WAF

Application firewall: a filter that tries to block malicious requests before they reach the site.

Backdoor / webshell

A back door left by an attacker to return to the server later.