PHP2Shell Security Connection: ‘Close Your Site From FBI’ Alert
Automatically translated
Admin21 September In October 2026, FBI Cyber Department made an open call to institutions: get offline if you are unable to update immediately. The objective of the warning was PHP2Shell vulnerability in PHP. W3Techs data According to the server-side language, about 70 percent of the sites that can be determined, two critical open in this language allows to run remote code without authentication with 9.2 CVSS score. In this article, what the vulnerability is, how the attack works, which versions are safe, and the concrete steps that the site managers should be thrown.
What is PHP2Shell Security Apparatus?
PHP2Shell is the common name of two separate vulnerabilities found in PHP core: CVE-2026-109618 and CVE-2026-109619. Both outdoors allow remote code to run without authentication. According to Huntress transfers CVE-2026-109619 can also lead to leaking data in the memory of the labor process. Open is located directly on the PHP.
The problem is dangerous as well as here. Open on a plugin of WordPress or not on the site’s own code, it’s on the engine running code. Based on Expel’s transfer PHP made a warning that some abuse paths may not leave a predictable log record, meaning a blank log cannot prove that the server is safe. Even if a institution has received their own code meticulously trust, it may be exposed to the version of PHP below.
Two openly, by the PHP security team, with 9.2 points in the CVSS v4.0 scale, that is critically rated. According to Help Net Security transfers the largest danger in installations using Apache mod php. A employee abuse can trigger attack before a single request without authentication.
Why did FBI And NSA Close Sites?
x.com/FBICyberDiv/status/2112921648252719420
The more sharp instruction was for those who can’t update. The expression that Digit is transferred FBI suggested that the systems that can not be updated immediately until they were completely removed. " Close the "site" of a state institution for a vulnerability summarizes the severity of the problem alone.
The warning was not limited to a single institution. According to the news of Defense One NSA warned FBI and CISA organizations together; W3Techs data Based on the server side, the roughly 70 percent of the sites that can be identified were reminded that PHP uses. The domain is very wide because PHP is located on the basis of platforms such as WordPress, Drupal and Joomla.
Turkey also moved rapidly. According to the transfer of Turkey Newspaper Presidential Cyber Security Presidency launched security screenings across the country, mainly public institutions and sent emergency measures notifications to relevant institutions. The weight of the angle confirmed the PHP Foundation's own security engineer. According to the transfer of The Journal Volker Dusch was awarded PHP2Shell in the description of Wall Street Journal as the most serious problem that PHP has encountered in more than ten years, and in 2014, he benzated Heartbleed deficit.
This assessment from the foundation’s own engineer explains why panic air is spread so fast. Newstürk's transfer based on Bloomberg HT The source of vulnerability is an error group born from the form of managing the computer memory of PHP.
How to Perform Attack Technically?
At the heart of the angle there is a job that PHP reaches the memory limit. From PHP security team to Alexandre Daubois’ analysis When memory limit is exceeded, the memory separator of PHP was thrown into the C function that wants memory and throw directly into the request functioning. The problem is: it could be published a marker without filling the structure behind it. mod php was wandering a structure that no one completes because it calls the closing routine if the request was not finished.
The only need of saldurga determine when the separator will fail exactly. According to the same analysis, multipart form separation offers several ways for it. A body that does not notify the expected length can pass the first size control. A form piece can carry numerous headers that consume much more memory as it covers on the network. The empty file areas are throwing the limit of the number of files and still creating topveri arrays. These are the ways to rub the separator at the desired time.
On the second open session (session) side. Based on Upwind's review error is experienced in session function following multipart loading progress. PHP stores some memory markers in permanent structures; this structure is destroyed and left behind a flagg when a second request session is read again. The next request arises when relying on this pointer, the use-after-free type is an error, so the code is running or the leak of memory.
Memory leakage path is also a risk per head. According to Wiz findings that Huntress transfers, a separate memory disclosure way can reveal password, token, API key and certificates. So even if aggressive code is not running, it can seriously damage the server's memory with leaked data. Fix according to Daubois touches 390 files, which shows how deep the problem is PHP.
Only logic of the attack above was explained; employee abuse code or step-by-step attack recipe was not given consciously. The aim is to evaluate the risk of managers correctly.
How to Open, What Role Playing Artificial Intelligence?
In addition to the most remarkable, how the deficit is located. Based on the transfer of Precursor Security The security team Calif identified the vulnerability OpenAI with the GPT-5.6 Left model within the "Patch the Planet" initiative; Wiz reported that two deficits are independently discovered and reported. PHP Foundation has been found with the help of artificial intelligence models of a deficit, which counts the most serious of more than ten years, as well as for the attack side sign of a new era reads.
Attack trials started before announcement. According to the same news of Help Net Security, Amazon’s MadPot Honeypot network recorded a PHP2Shell abuse trial on October 17, four days before public announcement. Amazon thinks that it is a threat vector behind the trial, but it is not yet known how the attacker reaches details when driving ambargo.
It was not planned to leak the process into the public. Based on The Hacker News On October 20, the two PHP vulnerability in Hacker News was shared on 22 October and PHP pulled out the pedestrian one day. According to Huntress, the post was removed, but the screenshots were so spread in social media at that time. The claim of leakage "CVSS 10.0" was covered with the official 9.2 points of PHP.
The chronology clearly shows how a deficit falls into the public without control. The sources of the table are the timeline of Daubois, Net Help Security and Huntress:
Date (2026) | News |
|---|---|
27 August | Open opens as security consultancy and is attributed to researchers |
25 September
Code change request for correction (PR) opens
17 October
Amazon MadPot network saves first abuse trial
October 20
The leak post on Hacker News is removed but the screenshots spread, PHP makes emergency patch announcement
21 September October
PHP makes official announcement and publish patched versions
This table outlines how a coordinated disclosure process of a deficit with the help of artificial intelligence can be leaked without completion.
Which PHP Versions Trust?
The first requirement of protection is to know the safe version. According to the news of Help Net Security, PHP team released four correction versions on October 21, 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. All versions under these versions in each branch are considered vulnerable. Latest vulnerable versions and support dates on the table Home Brandefense’s compilation based on php.net Home received.
PHP Branch | Defenseless Latest Version | Secure Version | Support Status u |
|---|---|---|---|
8. 5 | 8.5.11 | 8.5.12 | active up to 31 December 2027 |
8. 4 | 8.4.26 | 8.4.27 | active up to 31 December 2026 |
8. 3 | 8.3.35 | 8.3.36 | Security up to 31 December 2027 |
8. 2 | 8.2.34 | 8.2.35 | Security up to 31 December 2026 |
If the actual risk is supported in finished versions. Based on Mynet’s transfer PHP 8.1 and older versions no longer receive regular security updates from PHP project. This leaves an extensive part of the internet under permanent risk. According to CybelAngel's scan Open to the internet 2,24 million percent of the PHP server works in branches that will not come to the official fix version. The PHP security team, according to Help Net Security, also published the minimum patches at the source code level for 7.4, 8.0 and 8.1 due to the weight of the deficit; these are for those who compile PHP from source. Some distributions and long term support providers can also offer retrospective patches, so those who use these versions need to consult their providers.
How to Protect Sites from PHP2Shell Alet?
The protection consists of several steps. The common point of official alerts is the update of the single full solution.
Extract inventory: Identify where PHP works in your environment prior to FBI’s advice; priority to third-party products that include open systems to the internet and PHP.
Update PHP: Switch to secure version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) for each branch. The full protection according to the official announcement is provided only with the update.
Get offline if you are unable to update: FBI’s instruction is clear; the system that cannot be updated immediately is kept offline until it is completely removed.
Apply the official temporary measures correctly: Most repeated during leakage according to Daubois’ analysis session.upload_progress.enabled = Off The proposal only closes the session path of the second deficit (CVE-2026-109619), not the first deficit. The temporary measures recommended for the first open memory_limit=-1 to force the value of applications in a way that cannot change. These measures do not keep the place of the patch, only saves time.
Get behind WAF: If you are using a cloud WAF like Cloudflare according to Expel’s advice, make sure your origin servers only accept traffic over WAF.
Search for: According to the warning of FBI, PHP processes should be followed unexpectedly suspicious events such as scripting or file downloading; if the specification is seen, the system is isolated and logs should be stored.
Refresh the secrets that may be chopped: The way Wiz shows memory disclosure password, token, API key and certificates As it can be revealed, the regeneration of these secrets can be evaluated as a reasonable measure.
An additional size for institutions in Turkey is also the obligation to protect data. If a violation is detected in a system that processes personal data, the status of the Article 12 of the KVKK No. 6698 shall be reported to the relevant and Personal Data Protection Board as soon as possible. According to the public announcement of KVKK The decision of the Board dated 2019/10 predicts that the notification to the Board is made in 72 hours from the learning of the breach. Notice should be made as soon as possible for those affected. Therefore, PHP2Shell requires not only technical, but also a legal event intervention plan.
How Much Is The Exception And Data Leak Risk?
Resources in this question contradicts and is critical for contradiction managers. According to the compilation of Black Kite Since October 21, no institution reported a violation from this explains and explains CISA’s Known Exceptional Opens catalog the place was left.
On the other hand there are reports of attack traffic. According to the transfer of The Hacker News, Cloudflare announced that its customers see the targeted attack traffic and change their loads to overcome the rules of the firewall of the attackers. Based on SOCRadar’s compilation Aikido reported that abuse was reported on the field, Patchstack reported that it verified multiple active abuse cases; two companies were not publishing the technical detail of attacks. watchTowr's published information active abuse was observed as of October 21 in the company’s honeypot network. According to the update of The Hacker News, a confirmed breach for a specific server has not yet been reported, but the attack trials have already begun. This is not to be covered with the comfort of "no violation", just a reason to make the patch.
What does the community think?
Discussion on the developer side is moving on two axes: the role of the disclosure process and artificial intelligence. Hacker News discussion Some users found about two months of window between reporting and announcement for such a serious open. A user wrote that OpenAI’s vulnerability with Calif was found in a coincidence that he had been able to report as "independent" on the same day and asked how to walk coordinated disclosure.
The leak itself is also a separate discussion. The assessment of Daubois offers a balanced frame at this point: panic was justified about how serious the deficit is, but in most of the details that tell what it should be done. The fact that the most eradicate provisional measures are incorrectly revealed, how quickly the information that is not verified instantly. The habit that Daubois recommends for the next leakage is out of this course: trust in seriously, confirm the measure, ask which code path is covered before closing an adjustment.
Frequently Asked Questions
Does WordPress or Laravel close the vulnerability to update my site?
No. Not in open app, running it on the PHP engine. Check Point rating Update WordPress, Magento or Drupal does not turn off the vulnerability alone. The solution is to upgrade the PHP version on the server to secure version.
What should I do if I use shared hosting?
PHP in shared hosting usually manages hosting provider. Ask your provider’s secure version (8.5.12, 8.4.27, 8.3.36 or 8.2.35). The PHP version used in many hosting panels can be viewed and replaced by the user.
Is the site visitors under risk?
PHP2Shell’s goal is to servers running affected versions; not devices of end users directly. However, if the server is captured and user data is leaked, indirect visitors may also be affected. That’s why managers’ quick patch is important in terms of visitor safety.
Why does memory limit=-1 recommend, does this safety reduce?
Although the logic appears inverse at first glance is: it is necessary to predict when the attacker will exceed the memory limit to trigger the vulnerability. Remove the limit eliminates this predictable failure moment. This is only a temporary measure; permanent solution update.
Is open now actively abused?
There are attacks trials, there is no yet confirmed breach. As of October 21, the CISA two deficits also called Known Opens catalog; against it Cloudflare, Aikido, Patchstack and watchTowr reported attack traffic or active abuse. It is not recommended to wait for attack trials.
Artificial intelligence models are a powerful tool for defenders who help the most serious PHP deficit for over ten years. It stands as a separate question if the same speed passes through the attackers. How to change CISA catalog and new abuse reports in the next weeks will show that this balance will be heavy to which party.
Admin
