Updated on Thursday, Oct. 22 at 11:15 a.m. ET — The PHP security issues known as PHP2Shell sent the cybersecurity world into a frenzy yesterday, and now we have some data on the fallout.
VirusTotal, a cybersecurity tool owned by Google, reported that there are about 5.1 million IP addresses running PHP, showing just how widespread the vulnerability is.
Cogent Security, an agentic AI cybersecurity company, released data on how the issue affected big companies. Cogent reported that the average Fortune 500 company had 2,266 affected assets, with an average of 16 assets demanding immediate action. As of 8 p.m. ET on Wednesday, Cogent reported that less than 1 percent of affected assets had been patched.
PHP2Shell caused outages across the web, including at Wikipedia, and many government, gaming, and business websites required emergency maintenance. By Thursday morning, most services had been restored.
The PHP Foundation, the non-profit team behind the PHP coding language, released emergency security updates on Wednesday to fix two critical vulnerabilities, a day after details about the flaws leaked online.
The UK’s National Cyber Security Centre (NCSC), the Prime Minister of Japan, and the U.S. National Security Agency all urged organizations to install the fixes immediately.
The newly exposed PHP vulnerability led to a number of outages on Wednesday, as webmasters around the world scrambled to update their websites.
What is PHP?
PHP is a programming language that runs on web servers. When you load a webpage, PHP often runs behind the scenes, retrieving data from databases and building the page before it reaches your browser. BleepingComputer notes that it powers many websites, including content management systems, online stores, and custom web services. According to the NCSC, PHP is also built into a range of other products.
The NCSC says the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow an attacker to run their own commands on a PHP-based server without logging in. This is called remote code execution, and it’s one of the most serious kinds of security bugs.
Mashable Light Speed
According to the NCSC, an attacker could overload PHP’s memory to corrupt it, then, under certain conditions, use that corruption to take control of the server. One of the flaws involves how PHP processes form submissions and file uploads.
PHP rated each flaw 9.2 out of 10 on CVSS, the industry’s standard severity scale. Security firm watchTowr described them as a perfect 10, BleepingComputer reported, and so did an anonymous Hacker News post that has since been deleted. Researchers have started calling the bugs “PHP2SHELL.”
The fixes were originally planned for a coordinated release later this week, so companies would have time to prepare. Then, information about the flaws leaked early. Speaking to BleepingComputer, watchTowr CEO Benjamin Harris said the vulnerabilities are “indeed real” and affect PHP versions 5 through 8. The firm said it had reproduced one of them.
PHP moved its release up to 10 a.m. ET Wednesday. As of Tuesday, watchTowr said it hadn’t seen anyone exploiting the flaws. By Wednesday, Cloudflare CTO Dane Knecht said on X that the company was seeing early attacks, according to BleepingComputer.
This Tweet is currently unavailable. It might be loading or has been removed.
The NCSC says organizations running PHP 5 or later are affected and should update to the latest fixed version. Anyone still using an older, unsupported version should move to a supported one.
Wikipedia and government websites impacted by PHP vulnerability
Wikipedia went down for a time on Wednesday, and the Wikimedia Foundation, the nonprofit that runs the site, confirmed to Mashable that the outage was tied to the PHP vulnerabilities.
In a statement to Mashable through email, the foundation said it is working to address the flaws in PHP, which it described as the programming language behind most wikis, including its own projects. “This issue affects all known versions of PHP, and is not specific to the Wikimedia Foundation,” the statement said.
The foundation added that all of its PHP-based systems are affected, along with volunteer-run systems that use PHP. It has also taken several other systems offline as a precaution until they can be safely patched. Wikipedia was back up as of this writing.
Who else is affected, and what should you do?
If you only browse the web, there’s nothing for you to install. The fix is up to the people who run websites.
If you run a website, blog, or online store, check whether it uses PHP and make sure it’s up to date. If a hosting company manages your site, contact them to confirm they’ve applied the patch.
For organizations, the NCSC recommends:
-
Finding every system that runs PHP, starting with the ones reachable from the internet.
-
Watching for updates from vendors whose products include PHP.
-
Taking systems offline if they can’t be fixed quickly.
-
Checking any system that couldn’t be updated right away for signs of a break-in.
Cloudflare has added emergency firewall rules designed to block suspicious requests linked to the flaws. The rules are available to all its customers, including those on free plans.
Want to learn more about getting the best out of your tech? Sign up for Mashable’s Top Stories and Deals newsletters or get Mashable push alerts today.
