PHP flaw is being exploited: websites without the update are exposed
America's cyber agency, CISA, has listed both PHP2Shell flaws as actively exploited since 26 October; a researcher has documented successful attacks, and a third flaw remains unpatched.
On 24 October a security researcher at Perplexity recorded 35 successful attacks through one of the two PHP2Shell flaws on three test systems; two days later CISA added both flaws to its catalogue of actively exploited vulnerabilities. Whether attacks succeed is therefore settled: unpatched servers can be taken over.
What happened
PHP runs on about 70 per cent of websites, including online shops, customer portals and many WordPress-based systems. The updates were released on 21 October. According to Amazon, attack attempts began four days earlier. Researchers at Delft University of Technology counted more than 50,000 attack requests from over 600 addresses in 70 countries, 171 of which sent malicious code. The successful attacks hit PHP 8.4.26 on an Apache server; the researcher notes that his test systems were configured more simply than many production servers. Not everything has held up: Sophos downgraded earlier reports to failed attempts, and Palo Alto Networks withdrew a link to an intrusion at a European government agency. CISA has not said how many systems were actually compromised. American federal agencies must patch by 29 October. On 23 October the PHP team also published mitigations for a further flaw for which there is no update yet; it can be exploited only with an unusual combination of configuration and application code.
What follows
Assessment: proof of successful attacks moves the risk from theory into operations. Anyone who has not yet updated must assume that attackers have already probed their server. The risk to online banking itself is limited, as large banks rarely run core systems on publicly reachable PHP servers. The exposure lies at the edges: shops, small merchants' payment pages, agencies, local authorities and service providers, through which customer data can leak or payment forms be manipulated. For companies, the question of maintenance contracts becomes concrete: those whose website is run by an agency should know when it was updated. That security firms had to retract claims also shows how little is known about the real extent.
What changes in practice
- Website operators
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; experts advise taking unpatchable systems offline and checking for signs of intrusion.
- Companies using agencies
- Ask the provider whether and when the updates were installed; the website operator bears the risk.
- Users
- Watch for unfamiliar forms on smaller shops' payment pages; enter card details via well-known payment services where possible.
What to watch
- Reports of confirmed breaches at companies or authorities in Germany, Austria and Switzerland
- An update for the third, still unpatched PHP flaw
- New warnings from Germany's BSI on the patch status of German servers
Sources
- The Register: CISA confirms PHP2Shell under attack as researchers clock successful exploits (27.10.2026)
- BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited in attacks (27.10.2026)
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog
- Federal News Network: CISA gives agencies days to patch critical PHP bugs