PHP2Shell vulnerability causes global website outages

Critical PHP flaws rated 9.2 out of 10 lead to emergency updates and site shutdowns worldwide.

Two critical flaws in PHP, the scripting language powering most websites, have caused significant global disruptions. Discovered on October 20, these vulnerabilities forced numerous government and corporate sites offline as administrators scrambled to apply emergency updates released on October 21, 2026.

Dubbed PHP2Shell, these vulnerabilities are rated 9.2 out of 10 for severity. They allow unauthenticated attackers to execute arbitrary code, potentially accessing sensitive server memory and gaining direct paths to file systems or databases. The flaws were discovered using AI tools such as Wiz Atlas, Google Gemini, and OpenAI’s GPT, marking a significant event where AI-uncovered software flaws led to a massive infrastructure scramble.

The urgency was underscored by warnings from the FBI and the US National Security Agency. The vulnerabilities affect core memory management and error-handling parts of PHP, with nearly every web request potentially touching PHP2Shell.

PHP has released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Site owners are urged to install these updates promptly to mitigate risks. While users cannot directly fix the issue, they should monitor for breach notices and use strong, unique passwords.

Source: https://gulfnews.com/technology/website-blackouts-5-reasons-the-php2shell-bug-is-your-problem-too-1.500719496