Hundreds of websites have been taken offline as two PHP vulnerabilities, CVE-2026-109618CVSS 9.2 CRITICAL / Published 2026-10-21PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation.View on NVD and CVE-2026-109619CVSS 9.2 CRITICAL / Published 2026-10-21PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset.View on NVD, draw warnings from defenders. Both carry severity scores of 9.2 out of 10 and are rated critical by PHP. Cloudflare and watchTowr both report attacks against the flaws, which are being called PHP2Shell. Some estimates show that more than 70% of all websites on the internet use PHP, so the exposed surface is very large.
What happened
PHP rated both issues critical, each at 9.2 out of 10. Dane Knecht, the CTO of Cloudflare, said the company is already seeing attacks emerging, and Cloudflare released stopgap mitigations to help protect some customers. Jake Knott, head of threat intelligence for watchTowr, said his company is also observing in-the-wild exploitation.
Large companies and organizations like Nintendo and others took services offline as they addressed the bugs. Taking a service down is a blunt control, but it removes the exposure while patching and validation happen.
How it was done
Public reporting so far describes exploitation rather than full technical detail. watchTowr reports a variety of exploitation tools built with the help of AI, which shortens the gap between disclosure and broad opportunistic scanning. The nickname PHP2Shell points to the outcome operators are chasing on vulnerable hosts.
No attribution has been confirmed, and no single actor has been named. Treat any internet facing PHP deployment as reachable until you have confirmed its version and configuration yourself.
What to check
Work through these in order, starting with anything reachable from the internet.
Inventory every PHP runtime you actually run
Run php -v on each host and container image, and query your image registry for base images that bundle PHP. Include forgotten dependencies: marketing sites, admin panels, legacy CMS installs and vendor appliances. A bad result is any running version you cannot map to a patched release.
Patch or pin to a fixed PHP release
Check the official PHP release notes for the fixed versions covering CVE-2026-109618CVSS 9.2 CRITICAL / Published 2026-10-21PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation.View on NVD and CVE-2026-109619CVSS 9.2 CRITICAL / Published 2026-10-21PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset.View on NVD, then roll them through your package manager or rebuild images. Confirm the upgrade actually took effect with php -v and a request to a phpinfo style endpoint that you remove afterwards.
Apply edge mitigations while you patch
If you sit behind a web application firewall or CDN, verify the vendor rule set for these issues is enabled in blocking mode, not log only. Test with a staging request and confirm the block appears in your edge logs.
Hunt for exploitation in web logs
Grep access logs for unusual request paths, long or encoded query strings and POST bodies hitting PHP endpoints, for example grep -E 'php' on recent logs. Correlate with outbound connections from web hosts. Any new outbound traffic from a web server to an unknown host is a bad sign.
Look for web shells and new files
Run find on your document roots for files modified in the last few days, for example find /var/www -type f -mtime -7. Compare against your deployment artifact or a clean image. Files that no build produced should be treated as an incident.
Reduce what a compromised PHP process can reach
Review database credentials, cloud instance metadata access and outbound egress rules from web hosts. Restrict egress to known destinations and rotate any secret that a web process could read.