22OCT

PHP2Shell: no fix for PHP 8.1 and older

3 min read

16:31UTC

The PHP project shipped fixes on 21 October for two flaws that let anyone run commands on a web server, scored 9.2. Versions 8.1 and older get nothing, and a Detectify researcher puts roughly half of PHP websites there.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyAssessed

Key takeaway

Sites on PHP 8.1 or older must upgrade a whole version to close PHP2Shell.

The PHP project, which maintains the scripting language behind much of the web, shipped versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October. They fix CVE-2026-109618 and CVE-2026-109619, which let anyone on the internet run their own commands on an affected web server, no login needed, and score 9.2 out of 10⁠¹. "There are no complete mitigations, updating is the only safe choice," each release note says. PHP 8.1 and older get no fix, and the 8.2 notes say that branch reaches end of life on 31 December.

Joviane Jardim of Swedish security firm Detectify told The Record that roughly half of PHP websites run 8.1 or older, for which the only fix is a full version upgrade⁠². The project pre-announced the release on 20 October, about 18 hours ahead, and hundreds of sites went dark before a fix existed. France's data-protection regulator (CNIL), Nintendo, the OBS Project (makers of the free OBS Studio streaming software) and Berlin's Charité hospital took services offline.

Warnings came from the EU institutions' response team (CERT-EU), Germany's Federal Office for Information Security (BSI), Britain's National Cyber Security Centre (NCSC), the Dutch NCSC, CERT-FR and agencies in Japan and Australia. Jake Knott of security research firm WatchTowr Labs reported exploitation attempts in the wild, none yet successful.

CISA's short federal patch deadlines assume a patch exists, but for a site on 8.1 there is nothing to install: the work is a migration, with every application that depends on the old version tested again.

Deep Analysis

In plain English

PHP is a programming language that quietly runs a large share of websites. Its makers found two flaws that let anyone on the internet take over a web server running it, and released fixes on 21 October. They warned a day early, and some organisations, including Nintendo and a Berlin hospital, took their sites offline to be safe. Sites on PHP 8.1 or older get no fix, so their owners must move to a newer version.

Deep Analysis

Root Causes

PHP sits underneath content management systems, shops and hosting control panels. The application, not the language, decides which PHP versions it supports, which ties many sites to old branches long after upstream support ends.

Shared hosting compounds the problem. The host controls the PHP version, the site owner controls the application, and an upgrade needs both. PHP 8.2 losing support on 31 December widens the unpatched tail before the 8.1 tail has shrunk.

What could happen next?

Risk
Sites on PHP 8.1 or older have no upstream fix, leaving a large unpatchable population once working exploits circulate.
Short term · Assessed
Consequence
PHP 8.2 reaches end of life on 31 December, so another branch joins the unsupported tail within weeks of this fix.
Medium term · Assessed
Precedent
A short pre-announcement led organisations to take services offline before a patch existed, a cost future open-source disclosures will weigh.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Drupal's SQL injection in May drew mass attack attempts within 48 hours of its patch, across dozens of countries. A web-platform flaw with a published fix invites the same race once attackers read the patch.

Counter-parallel: CERT Polska's August Zimbra warning concerned a flaw exploitable only where specific services were enabled. The PHP project lists no configuration workaround for its flaws, so exposure tracks the installed version.

The first cost showed up as voluntary downtime: CNIL, Nintendo, the OBS Project and Charité took services offline rather than run unpatched. For hosting companies, the fix means a fleet-wide upgrade plus a wave of customer support.

The structural bill lands on owners of applications pinned to PHP 8.1 or older. They must fund a migration or rely on filtering rules that the PHP project itself does not count as a complete mitigation.

Consensus view: The PHP project's release notes say there are no complete mitigations and updating is the only safe choice. Jake Knott of WatchTowr Labs reports exploitation attempts in the wild, none yet successful, and Cloudflare chief technology officer Dane Knecht says attacks are emerging and the firm has deployed stopgap rules.

Counter-view: Detectify's Joviane Jardim puts roughly half of PHP websites on 8.1 or older, which get no fix at all. For those sites, updating means a full version migration, so traffic-filtering rules from hosts and CDNs carry the near-term defence for a large share of the web.

Key tension: Whether the 18-hour pre-announcement helped defenders more than attackers, given that hundreds of sites went dark before any fix existed.

First Reported In

Update #15 · Fridge hack spoils food in seven countries

PHP Group· 22 Oct 2026

Read original →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.