Two critical PHP vulnerabilities, dubbed php2shell, forced institutions and websites around the world to take their sites offline on Wednesday, 21 October. PHP’s developers have released patches, and CERT Polska is urging administrators to update immediately.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP team rated each at 9.2 out of 10 on the CVSS 4.0 scale, according to The Record. They allow remote code execution on an unsecured server. According to CERT Polska, all PHP versions from 5.0 onward are affected.
Who took their sites down
According to Reuters, government websites in Europe and beyond went offline on Wednesday. The Dutch cybersecurity agency took its own website down as a precaution. The Wikimedia Foundation disabled some of its systems until they could be patched, and the Internet Archive was briefly unavailable. The Canadian government temporarily shut down some of its websites, as Minister Evan Solomon reported, according to Global News. We covered the decisions made by European government offices in more detail in our article on government websites taken offline.
The flaws were discovered with the help of artificial intelligence. According to Reuters, the firms Calif and Wiz independently described them. Calif said it found the bugs using a large language model on 1 August. OpenAI said it worked with PHP on testing the fixes. Information about the flaws leaked on 20 October, before the planned disclosure, so PHP’s developers issued a warning earlier than intended.
In Poland, some websites of the BIP (Public Information Bulletin) were taken offline. The Minister of Digital Affairs announced this on X:
Patches and CERT Polska’s recommendations
The secure versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The patches were published on Wednesday afternoon, Polish time. In its advisory, CERT Polska notes that configuration changes do not rule out exploitation of the flaws. Only updating PHP fully protects against them. The team also recommended taking an inventory of services that use PHP and temporarily disabling those that cannot be updated right away. Linux users should wait for packages from their distribution’s vendor. For ready-made devices and Docker images, you will need to wait for a new version from the manufacturer.
CERT Polska also published a post on X:
The attacks have already begun
Cloudflare has observed early attack attempts, according to its CTO Dane Knecht, as reported by Fortune. The firm watchTowr is seeing attempts using tools written with the help of AI. Its representative Jake Knott said that so far no one has succeeded, but he does not expect that to last long. Experts quoted by Reuters fear a wave of break-ins, because once a patch is published, it is easy to work out what the bug was.
What it means for readers in Poland
Ordinary internet users do not need to install anything. The problem concerns administrators. It affects owners of shops, blogs and company websites built on WordPress, Joomla or phpMyAdmin. According to W3Techs, PHP is used by 69.3% of websites whose server-side language can be identified. A website owner on shared hosting should check whether the provider has already deployed a patched PHP version. If not, they should ask about a timeline. In the meantime, it is worth handling login credentials and backups with care.
