PHP released fixes for two server flaws known as PHP2Shell on October 21, 2026. The fixes protect a server only after its owner installs them and restarts PHP; the source says there is no complete alternative mitigation. PHP 8.1 and earlier receive no official releases, though PHP’s security team posted limited patches for people who compile versions 7.4, 8.0 and 8.1 themselves.
Cloudflare CEO Matthew Prince said exploit attempts on its network had reached the millions. Amazon said a decoy server logged an attempt on October 17, before public disclosure, and said the flaws were being broadly exploited. Germany’s BSI said it had seen attacks but no successful use of the flaws, while Japan’s government said it had confirmed no attacks exploiting them. The PHP Foundation said it saw early signs of one flaw in 2024 and called the delay in fixing it a “structural failure.”
