Note, 24 October 2026

PHP2Shell, and why being able to patch in an hour is the real fix

On 21 October 2026 PHP fixed two critical flaws that, in php.net's words, "can allow unauthenticated remote code execution". AI helped find them, and they reach back to PHP 5.4, released in 2012. That same day the Netherlands and Finland switched off some of their own government websites, and Final Fantasy XIV stopped new logins. On purpose.

What happened

PHP runs on 69.3% of the websites whose server-side language W3Techs knows. PHP's advisory says "all PHP installations serving web requests" are at risk. The fixes, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, came out at 14:00 UTC on 21 October. The PHP Foundation says the release moved up a day after the flaws' ID numbers leaked.

Researchers at the security firms Calif and Wiz found the flaws with AI tools, the BBC reported. SecurityWeek reported that the flaws affect nearly all PHP releases back to version 5.4, which php.net released on 1 March 2012. The PHP Foundation says "the first signs" of one problem were found in 2024.

Cloudflare's CEO, quoted by OfficeChai on 22 October, reported "thousands" of attempts across Cloudflare's network in the 10 hours before the announcement, then "tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now." Those are attempts, not break-ins. AWS saw an attempt on its honeypots dated 17 October, "four days before public disclosure", and says "it remains unclear how the actor acquired exploit information".

The switch-offs came on 21 October. In Finland, Valtori began shutting down the state administration's public internet services at 12:45 local time. The Dutch government named Overheid.nl, MijnOverheid.nl and DigiD among sites taken offline "uit voorzorg", as a precaution. Both moved before the fix was out, and both said they had no sign of active abuse yet. Final Fantasy XIV took its patch servers offline "to ensure security", so new logins stopped on all worlds until 22 October.

CISA told organizations that cannot update immediately to "take PHP-based systems offline until they can be patched or updated." The Dutch NCSC said on 22 October to keep still-vulnerable systems offline until updated. An EU joint statement said to "consider isolating exposed applications from public networks". On 23 October the Dutch NCSC knew of one report of possible abuse abroad, not confirmed as successful.

Why a setting wasn't enough

PHP's advisory lists stopgap settings. In its words, they "reduce exposure to specific attack paths but do not make an installation safe", and "only an update is a complete solution". And until the project's release on the afternoon of 21 October, most sites had no fixed PHP to install, so only being offline fully protected them.

What we would build so a fix ships in an hour

Our take: being able to patch in an hour is the real fix. Switching off is what is left when you can't. Here is what that takes, for any connected product or service, devices included.

Know what runs where. CISA's first step was to "identify and inventory systems running any version of PHP", which "is often a component of other software". List every component and version in every server, build and firmware image, so "do we ship this, and where?" takes minutes. Rehearse the update path: send routine updates down the pipeline an emergency will use, with tests, a staged rollout and a way back. On a device, that means signed over-the-air updates and a fallback image.

Make parts switchable. The Dutch government's main site, Rijksoverheid.nl, doesn't use PHP; it stayed up and reported DigiD offline. Let one service go dark without the rest, and let a device keep working locally when its cloud is offline. Then measure. AWS's advice is to "measure patch and mitigation timelines in hours". On a normal day, pretend a fix just shipped for one dependency, and time how long it takes to reach every server and device. That number is how long you stay exposed.

If you run PHP

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or take your Linux distribution's patched package. PHP 8.1 and older get no updates from the PHP project; ask your vendor for a backport, or upgrade. If someone else runs your site, ask your host, as the Dutch NCSC advises. The official advisory is on php.net. On 23 October php.net added an advisory on one more, unlikely path the update doesn't close yet; read that too.

Transcript

AI helped find a hole in the code behind most websites. It had been there for at least 14 years. 45 minutes after it went public: tens of thousands of break-in attempts.

That same day, governments did something you almost never see. They switched off their own websites. Final Fantasy 14 stopped new logins. On purpose.

Why not just fix it? No setting fully blocks it. Only the update does. And on a server that isn't updated, a stranger could run their own code. So agencies in the US and Europe said: if you can't patch now, take the site offline. And someone tried an attack four days before the fix came out.

AI beat attackers to this one, as far as we know. It won't be the last. Being able to patch in an hour is the real fix.

All notes