What Happened With the PHP Flaws Disclosed on October 21

Two Bugs, Then a Patch

On October 21, researchers published two vulnerabilities in PHP, and the PHP project shipped fixes the same day. The flaws had been in the language for years. They sit in how PHP handles memory and fatal errors, which is code that runs on ordinary page requests, not in an optional plugin.

Wiz Research, working with Calif and an OpenAI research program, named the pair PHP2Shell. The issues are CVE-2026-109618 and CVE-2026-109619, both scored 9.2 out of 10. Wiz’s account says an unauthenticated attacker could run code on a vulnerable server, or read memory from the PHP process. That memory can include passwords, tokens, and API keys belonging to other requests. Wiz showed this against current WordPress, Drupal, and Joomla images, and said the same engine-level bugs apply to other PHP apps, including a small custom site.

PHP is the open-source language that assembles a lot of the web on the server. Wiz puts that share at about 70 percent of websites. CBC News, citing W3Techs, put it nearer 75 percent. WordPress, Drupal, Joomla, and Wikipedia’s MediaWiki are the familiar names. The language is maintained by the PHP Foundation, a small non-profit with volunteer board members and a handful of developers.

How It Was Found

Wiz’s timeline starts on August 19, 2026, when the team found the first issue using its own tooling plus Gemini 4 Argon and GPT-5.6 Sol. They confirmed code execution against Drupal the next day and against WordPress the day after that. They reported it to PHP’s security team on August 24. PHP acknowledged the reports on September 21 and started a coordinated fix. Patches and the public write-ups landed on October 21.

Ryan Austin at Calif told CBC he had been looking near a PHP bug from 2004, and pointed a model at that part of the code. A few days later the group had a serious finding. The PHP Foundation told CBC that a researcher had described this class of problem in 2024, without a concrete way to use it. The Foundation called the gap between that theory and a fix a structural failure: limited resources, and a security process that did not move the work along. The underlying code had been in PHP for more than a decade, back through releases to PHP 5.4.

Before publication, Wiz worked with the PHP team, Calif, and OpenAI on the fix. Hosting and security companies including Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, and Vercel prepared customer notes and mitigations for people who could not update on the day.

Why Sites Went Offline

A number of operators took websites down while they installed the update. CBC reported Canadian government sites among them, plus sites in France and Japan. Newfoundland and Labrador and Prince Edward Island were offline on Wednesday and appeared to be running again on Thursday. Elections BC took its site down as well.

Reuters reported the same pattern outside Canada. Japan’s Finance Ministry temporarily suspended some website content. Mitsubishi UFJ Financial Group suspended some internet services while it applied emergency measures. Prime Minister Sanae Takaichi asked site owners to check whether they use PHP and to prepare for the update. Government cybersecurity agencies, including in Canada, repeated PHP’s request to update. The NSA’s cyber unit said organizations that could not patch immediately should take sites offline until they could.

Carmi Levy, a technology analyst CBC spoke to in London, Ontario, described those takedowns as the maintenance path working: the bugs were reported, a fix existed, and operators pulled sites rather than leave the old version answering requests. Isaac Privett at the Toronto firm Packetlabs told CBC that installing a current PHP version is the update that addresses it, closer to a system update than to a rewrite of the site.

Attempts After the Announcement

Cloudflare chief executive Matthew Prince posted numbers Reuters quoted. In the 10 hours before the public announcement, Cloudflare saw thousands of exploit attempts on its network. That rose to tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and millions after that.

CBC reported that some sites saw attempts once the details were public, and that those attempts did not appear to succeed. The PHP Foundation told CBC on Wednesday it had not seen evidence of a successful exploit. The attempts and a confirmed compromise are separate facts. One was measured. The other, as of that statement, was not.

The Releases That Include the Fix

PHP told users to update. The patched releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. A plugin or theme update does not change the PHP version the server is running. The version is the thing the host, or the team that deploys the app, can read out.

Privett’s other comment to CBC was about the hours around disclosure. The bug and the fix were public at the same time, so after the new version is in place it is reasonable to look for signs someone reached the server before the update. For people who only visit these sites, CBC’s note was the usual one: passwords that are not reused, and two-factor authentication, so a password exposed at one service is less useful anywhere else.

Book a Free Systems Review The Railway Key Rotation