[REVISION HISTORY]

Global impact and government responses to PHP2Shell

Updated 33 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-26 18:57 UTC → 2026-10-26 19:41 UTC · added ~~removed~~

The security crisis surrounding the PHP vulnerabilities known as ‘PHP2Shell’ (CVE-2026-109618 and CVE-2026-109619) has escalated into a global cybersecurity emergency. These flaws, carrying a severity rating of 9.2 out of 10, allow for unauthenticated remote code execution (RCE). Security researchers from Palo Alto Networks and Trail of Bits have confirmed successful exploitation on live targets, while Amazon reported detecting attempts four days prior to official disclosure. The impact is widespread due to PHP powering an estimated 69% to 75% of websites with identifiable server-side technology, including platforms like WordPress and Drupal. In Brazil, the vulnerabilities prompted the preventive shutdown of several government systems, including federal courts and Anatel. In Ghana, the CSA and NITA issued urgent directives requiring government institutions to patch systems within seven days. Previously, telemetry recorded millions of exploitation attempts, including Mirai botnet deployments and a breach of a European government agency involving password hashes and MFA secrets. A new RCE vulnerability, CVE-2026-115560, was also identified affecting specific ‘session.serialize_handler’ configurations. While the PHP project released patches on October 21, 2026, for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, users on PHP 8.1 or older remain at risk as those versions no longer receive official security updates. In Italy, CERT-AGID identified at least 650 potentially vulnerable URLs within the Index of Public Administrations. By late October, the crisis has been described by some as ‘Black October,’ a period marked by a massive wave of cybersecurity incidents. Beyond PHP, high-severity flaws were identified in Node.js, Java, GitLab, Railway, WordPress, and the AI tool LiteLLM. Security experts warn that automated AI agents are actively scanning for these vulnerabilities to launch attacks, and the vast scale of the issue leaves many sites and datasets potentially exposed during the patching process.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.