PHP vulnerability 2026: NSA says patch PHP2Shell now or take sites offline

The biggest PHP vulnerability in years landed on October 21, 2026. The PHP project shipped emergency fixes for two critical flaws, nicknamed PHP2Shell, that can let an attacker take over a web server without a password or any prior access. Within hours the US National Security Agency told organisations to update immediately, and to take systems offline if they can't patch right away. PHP runs a huge share of the web, from WordPress blogs to government portals, so this one touches almost everyone who runs a website.

Our 27-second version, with the 3-step fix:

What is the PHP2Shell vulnerability (the PHP vulnerability of 2026)?

PHP2Shell is two bugs, tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project rates both 9.2 out of 10 (critical) on the CVSS v4.0 scale. A leaked early write-up had claimed 10.0. According to PHP's release notes, the flaws "can allow unauthenticated remote code execution". In plain words: someone on the internet can run their own code on your server, no login needed.

The NSA's advisory stresses the key detail: these are flaws in PHP itself, not in the app or its settings. "Servers running affected PHP versions are exploitable." A well-written site is still at risk if the PHP underneath it is old. A PHP security team member wrote on oss-security that remote code execution has been demonstrated against Apache with mod_php.

Which PHP versions are fixed?

The PHP project released fixes on Wednesday, October 21:

Branch	Update to
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 8.1 and older	No official release. Reports say minimal source patches exist for some older branches; plan to upgrade

PHP's own notes are blunt: "There are no complete mitigations, updating is the only safe choice." Public reporting says versions going back to PHP 5 are affected. If you run an end-of-life PHP version, the NSA recommends replacing those services, because they won't get a patch.

What did the NSA say?

The NSA's advice, issued the same day, has four parts:

• Inventory: list everything you run that relies on PHP, especially anything facing the internet.
• Patch fast: apply the PHP updates, and vendor updates as they arrive, since hosting panels, CMS bundles and appliances ship their own PHP.
• Watch closely: add logging, and replace PHP versions that can't be patched.
• Go offline if you must: "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated."

The agency says the risk is serious enough to require immediate patching across US government departments and agencies. CISA, the US cyber defence agency, also urged everyone to install the update. CISA said these flaws "affect all PHP installations serving web requests", and that it had not seen them exploited when it published its alert.

Are attackers already using it?

The picture is mixed. CISA says it had not observed exploitation when it published its alert, and neither CVE was in its Known Exploited Vulnerabilities list at the time of writing. Several security firms, including watchTowr and Patchstack, say they are seeing exploit attempts. The bug details also leaked before the fix was public, so assume attackers are scanning. As one Ox Security researcher told The National: "If you have a publicly accessible PHP instance and haven't patched it, start from the assumption that you're exposed."

Why are government websites going offline?

Because they are following that advice. According to The National, the Netherlands, Finland, France and Australia temporarily took some government services offline to patch. Japan's prime minister, Sanae Takaichi, urged everyone to "take action tonight". Pulling a site briefly is the safe choice when you can't update instantly: a few hours of downtime beats a server takeover.

AI found these bugs

There is a twist. OpenAI says one of its models helped researchers find the flaws as part of its "Patch the Planet" security work. It called PHP2Shell "one of the most impactful vulnerabilities in recent memory" and said frontier AI found it "ahead of attackers, giving defenders time to prepare". That fits a wider pattern: Google also pitched its newest model as a tool for defenders first, as we covered in Gemini 4 Argon goes to cyber defenders first.

What should you do right now?

1. Check your version. On the server, run php -v. In WordPress, go to Tools → Site Health → Info → Server. On shared hosting, look in the hosting control panel or ask your host.
2. Update to a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your Linux distribution's patched package. Restart PHP-FPM or Apache afterwards so the new version is actually running.
3. If you can't update today, take public PHP sites offline or put them behind maintenance mode until you can. That is the NSA's advice.
4. On PHP 8.1 or older, schedule an upgrade to a supported branch now.
5. Look for signs of compromise if your server was exposed: new admin users, unknown files in web folders, or odd outbound connections.

Managed platforms such as large hosting companies and cloud providers are rolling out patches, but check that yours has, rather than assuming.