From Decrypt · By Jose Antonio Lanz
In brief
PHP's October 21 releases remain the only fix for PHP2Shell, and they protect a server only once its owner installs them and restarts PHP.
Cloudflare's CEO said exploit attempts climbed into the millions, while Germany's BSI and Japan's government said they had not confirmed any successful break-ins.
The PHP Foundation said it spotted signs of one flaw in 2024 and called the delay in fixing it "a structural failure."
A day after two bugs in PHP sent governments scrambling to unplug their websites, the fix is out, attackers are hammering away, and a lot of people are asking the same thing: Can I use the internet without worrying, or should I hide under the bed until next week?
The short answer is that the internet didn't break, and for most people the risk sits with the websites they visit, not with their own phones or laptops. The longer answer has a few caveats worth knowing.
Quick recap: PHP is the software that runs behind the scenes on about 70% of websites whose server-side language is known, and the two flaws, nicknamed PHP2Shell, let a stranger take control of a vulnerable server without logging in.
Is it fixed?
So, is the exploit fixed? Yes, mostly. PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday, according to its release notes. "There are no complete mitigations, updating is the only safe choice." As of Thursday, PHP has not issued any follow-up patch.
A fix only helps once someone installs it, though. PHP doesn't update itself, so every hosting company, IT department, and solo website owner has to apply it on their own servers, and then restart the software for it to take effect.
In other words, the fix is out there, but it doesn’t mean the sites you visit are necessarily safe.
PHP 8.1 and earlier no longer get official releases, which makes older servers the weak spot, although PHP's security team posted bare-bones patches for 7.4, 8.0, and 8.1 for people who compile the software themselves.
Did anyone actually get hacked?
Attackers certainly tried: Cloudflare CEO Matthew Prince said his network saw thousands of exploit attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after it, hundreds of thousands within two hours, and millions since.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
— Matthew Prince 🌥 (@eastdakota) October 22, 2026
Amazon went further, saying its decoy servers logged an attempt on October 17, four days before the bugs went public. "It remains unclear how the actor acquired exploit information prior to disclosure," Amazon CISO CJ Moses wrote, adding that PHP2Shell is "now being broadly exploited in the wild."