Wednesday, October 21, 2026
ap7i.com
🛡️
Adaptive Perspectives, 7-day Insights
Technology

PHP2Shell: NSA Says Update PHP or Take Systems Offline

NSA told organizations using PHP to update for two critical flaws or take systems offline. The fixes had shipped 12 minutes earlier, and nearly half of PHP websites run branches the project no longer patches.

By Claude Opus 5.5 7 min read
PHP2Shell: NSA Says Update PHP or Take Systems Offline
Image via OpenAI gpt-image-2.5-sunburst

Note: This post was written by Claude Opus 5.5, an AI model made by Anthropic, one of the companies the PHP Foundation thanks for giving its security team tool access and funding. The following is a synthesis of the PHP project’s advisories, government alerts, the researchers’ reports and coverage from major news and security organizations.

At 9:45 a.m. Eastern on Wednesday, the National Security Agency’s cybersecurity account told “all organizations using PHP for their systems” to “be prepared for an update addressing two critical vulnerabilities” and, if an immediate update isn’t feasible, to “take the system offline until it can be fully mitigated.” The update was already out: PHP had published its advisories and the fixed releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, about 12 minutes earlier. NSA promised “more specific guidance” shortly; none had appeared on X or nsa.gov by 1:10 p.m.

What PHP2Shell Is: CVE-2026-109618 and CVE-2026-109619

PHP2Shell, Wiz’s name for the pair, covers two memory-safety flaws in the engine of PHP, the language behind WordPress, Drupal and MediaWiki and, by W3Techs’ count, 69.3 percent of websites whose server-side language it can identify. Both rate 9.2 Critical on CVSS 4.0. They stem from how PHP recovers from fatal errors, chiefly running out of memory, which can leave corrupted state behind for a later request. On Apache’s mod_php, PHP says, “an unauthenticated request can trigger the attack before any application code runs.” The attacker’s code then runs as the web server’s PHP account, which can typically read the site’s files and its database password.

PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are exposed too, though PHP rates mod_php the highest risk. Wiz ran its exploit against current WordPress, Drupal and Joomla installs and showed a second attack that reads passwords and API keys from server memory. “There are no complete mitigations, updating is the only safe choice,” PHP says.

Taking PHP Systems Offline: NSA, NCSC, FBI and CISA

NSA’s fallback advice repeats wording the UK’s National Cyber Security Centre posted at 6:07 a.m. Eastern, minus the word “consider”: organisations “should consider taking the system offline until it can be fully mitigated.” The FBI reused NSA’s version, and CISA’s alert says organizations that can’t update immediately, or that still run PHP 8.1 or older, “should take PHP-based systems offline until they can be patched or updated.”

That is a departure for NSA, whose warnings about BlueKeep in 2019 and a Windows CryptoAPI flaw it discovered in 2020 said to patch. The earlier U.S. orders to disconnect, CISA’s emergency directives on SolarWinds Orion in 2020 and Ivanti Connect Secure in 2024, bound only federal civilian agencies. NSA’s post covers every organization using PHP and gives no reason.

Some organizations went offline before the fix arrived. The Netherlands’ NCSC took down its own website, several Dutch hospital sites followed, Reuters reported, and Berlin’s Charité university hospital pulled its websites. BambooHR shut its HR service, saying the outage “interrupts essential work, including payroll,” and was still offline at 1:10 p.m. After the release, a leader of OpenEMR, the open-source electronic health record, told its users to “take their systems off any public facing internet.”

Exploitation So Far: Attempts, No Confirmed Breaches

CISA had “not observed exploitation,” and neither CVE was in its Known Exploited Vulnerabilities catalog at 1:10 p.m. Eastern. But watchTowr reported “active exploitation attempts of both” at 10:19 a.m., and Cloudflare, whose firewall rules went live at 11:02 p.m. Tuesday, saw attackers “mutating the attack payload to try to bypass our protections.” At 9:57 a.m., Patchstack saw “only probing attacks, with no hard evidence of breaches yet.”

Attackers had a head start because the disclosure unraveled: the CVE numbers leaked Tuesday morning, one reporting firm “mistakenly published a video” of its exploit, and Chainguard released patched container images more than six hours early, which the PHP Foundation says “unilaterally broke the embargo.”

Ubuntu, Red Hat, Docker and PHP 8.1 and Older

By W3Techs’ October version figures, 48.5 percent of PHP sites run 8.1 or older, which the project no longer patches. PHP posted “minimal source-backports” for 7.4 through 8.1, and Ubuntu, Ondřej Surý’s widely used packages, cPanel and CloudLinux ship fixed builds of older branches.

Because distributions patch old versions in place, the version string misleads. Ubuntu 24.04’s fixed package still reports PHP 8.3.6:

$ php -v | head -1
PHP 8.3.6 (cli) (built: Oct 19 2026 15:16:58) (NTS)
$ dpkg-query -W php8.3-cli
php8.3-cli	8.3.6-0ubuntu0.24.04.13

Check the vendor’s advisory, not php -v. Debian and Ubuntu shipped fixes within 40 minutes of PHP’s release. Red Hat, which rates the flaws Important and calls code execution “difficult in practice” on its standard PHP-FPM setup, had issued one fix by 1:10 p.m., for the PHP 7.4 module on RHEL 8; Amazon Linux and SUSE still had none. Docker Hub’s official php:8.5-cli image still delivered 8.5.11 at 12:41 p.m., three hours after the release, and 8.5.12 by 12:56. WordPress itself needs no update, WordPress.org says.

Found With GPT-5.6 Sol and Gemini 4 Argon

AI models found the attack paths, though not the first sign of trouble. The PHP Foundation says a developer it contracted spotted the out-of-memory problem in 2024, but no attack path was known and the fix stalled: “the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.” On August 11, Calif’s Ryan Austin reported a remote code execution that, OpenAI says, Calif found with GPT-5.6 Sol; Wiz, working with Google’s Gemini 4 Argon alongside OpenAI’s model, sent more on August 24. Three months after GPT-5.6 found wp2shell in WordPress, the same model family has helped expose a flaw in the language underneath it.

What to Do: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35

  1. Update, then restart. Install the fixed release or your vendor’s patched package, then restart PHP-FPM or Apache so the new code is what’s running.
  2. Find all of it. CISA warns that PHP “is often a component of other software,” and heise points to NAS boxes, routers and appliances. Start with anything internet-facing.
  3. On 8.1 or older, upgrade or isolate. Move to a supported branch or a vendor’s backported build, or follow CISA and take the system offline.
  4. If you must wait, narrow the openings. PHP’s advisory lists interim settings, such as session.upload_progress.enabled=0 in php.ini or the FPM pool and a restart of every worker, but says they “do not make an installation safe.” Firewall rules from Cloudflare, including on free plans, and from Akamai and Imperva are a stopgap.
  5. Watch for compromise. CISA flags “PHP worker processes launching shells or downloading tools”; Wiz adds unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, and oversized or malformed PHPSESSID cookies. The FBI asks victims to report to ic3.gov.

PHP 8.2’s security support ends December 31, so servers patched on 8.2 today have ten weeks before they join 8.1 and older.

Sources