PHP2Shell: The Leaked Bug That Broke the Web Today
Wednesday, October 21, 2026 · 5-minute read
Government websites across Europe went offline today after details of two critical PHP flaws leaked a day ahead of their planned disclosure. The bugs — nicknamed PHP2Shell — let attackers run any code they want on a web server without needing a password or account. Reuters confirmed the outages, and Cloudflare says it spotted real exploit attempts starting in the early hours of the morning UTC.
↗ The Hacker News / Krebs on SecurityCISA published a formal advisory today warning that the ransomware group SafePay has breached over 600 critical infrastructure organizations worldwide since 2024. The targets include sectors like energy, water, and healthcare — the kinds of systems that affect daily life if they go down. CISA's advisory is a signal that SafePay has reached a scale serious enough for a public government warning.
↗ BleepingComputer / CISAThe Department of Homeland Security told all federal civilian agencies to stop using DeepSeek AI products and delete them from government systems. DeepSeek is a Chinese-made AI platform that raised national security concerns over data handling and potential foreign government access. This follows a pattern of the U.S. government restricting Chinese technology from sensitive networks.
↗ BleepingComputerClickFix attacks are at an all-time high, and cybercriminals have found a powerful new lure: fake AI tool installers. You might see a page pretending to be ChatGPT, Claude, or another popular AI assistant. It shows a fake error or verification screen and asks you to copy a command and paste it into your Windows Run dialog or Mac Terminal. The moment you hit Enter, malware installs itself — often a password-stealing program or a tool that gives the attacker remote control of your machine. Google is rolling out new Chrome warnings to flag this, but the attacks are evolving fast.
A hacker broke into the website of TeamUpdraft — the company behind popular WordPress backup plugins — and stole connection keys for UpdraftCentral, a dashboard that manages multiple WordPress sites at once. Anyone holding those stolen keys could send commands to connected websites, potentially defacing them, stealing data, or planting malware. If you manage WordPress sites through UpdraftCentral, your sites may have been exposed even if you did nothing wrong.
These two flaws — together called PHP2Shell — sit inside PHP itself, the software that powers roughly 70% of all websites. An attacker who finds a vulnerable server can run any command they want on it without needing a username or password. What makes this especially nasty: the bug is in PHP's core engine, not in any website's own code. Even a perfectly written website is exposed if it runs on an unpatched server. Researchers at Wiz and OpenAI found the flaws. Cloudflare detected early exploit attempts and pushed emergency firewall rules at 3:02 AM UTC today.
Status: Emergency patch released today — fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Update immediately. No workaround fully protects an unpatched server.
CISA is urging organizations to patch a critical flaw in BeyondTrust Remote Support, a tool that IT teams use to remotely access and fix computers. A vulnerability in this kind of software is high-value for attackers because it already has deep access to the machines it manages — exploiting it could give an attacker control over an entire corporate network through a single entry point.
Status: CISA alert issued October 16. Apply the vendor patch immediately if your organization uses BeyondTrust Remote Support.
Certificate authority eMudhra revoked eight intermediate certificates after researchers found their private keys were so weak they could be cracked almost instantly. With those keys, anyone could create forged certificates for legitimate websites — meaning they could make a fake bank or government site appear completely trusted by your browser. Mozilla, Google, and Apple have all blocked the compromised certificates in their browsers.
Status: Certificates revoked and blocked by major browsers. No action needed from regular users — browser updates handle this automatically.
Google is rolling out new protections in Chrome that specifically detect ClickFix attacks — the trick where a website fakes an error and tells you to paste a command into your computer. The new warnings fire when Chrome's Enhanced Protection mode is on and it spots a page trying to push you toward pasting something into Windows Run or Mac Terminal. This is notable because ClickFix bypasses most traditional security tools — it works by getting you to install malware yourself, so no file is downloaded automatically. Built-in browser-level detection is one of the few defenses that can catch it early. You can turn on Enhanced Protection in Chrome under Settings → Privacy and Security → Safe Browsing.
Security firm Proofpoint shared new research at its Protect 2026 conference showing that generative AI has transformed phishing emails. Old scam messages were easy to spot: bad grammar, generic greetings, copy-pasted templates. Now, AI writes unique, fluent, personalized messages for each target. In one example, a single attacker contacted 30 real estate agents at the same company — each from a different account, about a different property, in different words — before asking each one to join a video meeting. The FBI counted nearly $900 million in AI-linked losses in 2025. This isn't a future problem; it's happening now.
Imagine someone publishes a master key for 70% of the world's front doors — one day before the locksmith was planning to hand out new locks. That's roughly what happened today. Two critical vulnerabilities in PHP, the programming language that runs the majority of the web, were supposed to be disclosed in a coordinated way on October 22. Someone leaked the details early. Emergency patches dropped today instead, and the internet scrambled.
The flaws — CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell — aren't bugs in any particular website. They're bugs in PHP itself, the engine underneath WordPress, Drupal, Joomla, Magento, and countless other platforms. A vulnerable server exposes every site running on it, even if those sites were coded perfectly. The risk is highest on servers using a common configuration called Apache's mod_php, where the flaw can be triggered before any of a website's own code even loads. Researchers at Wiz and OpenAI found both bugs and reported them responsibly — but responsible disclosure only works when the timeline holds.
For regular people, this matters because the sites you visit every day — your favorite news site, your local government's portal, your favorite online shop — may have gone offline today or may still be running vulnerable software right now. Cloudflare confirmed it saw exploit attempts early this morning and pushed emergency WAF rules to protect sites behind its network. European government sites reportedly went dark. Reuters covered the outages. OpenAI called it "one of the most impactful security issues in recent memory."
The patch is out now — PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you run a website, your hosting provider or developer needs to apply this update today, not this week. If you don't run a website, your job is patience: expect some sites to be slow or broken, and don't hand over sensitive information to any site that looks degraded or unusual until it's confirmed to be patched. Watch for follow-up reporting over the next 48 hours — if working exploits spread further, more outages are likely.