Updated at 11:15 a.m. ET on Thursday, October 22 – PHP security issues known as PHP2Shell sent cyber security The world was in a frenzy yesterday, and now we have some data on the fallout.
virustotalThe Google-owned cybersecurity tool reported that there are approximately 5.1 million IP addresses running PHP, which shows how widespread the vulnerability is.
solid securityAn agentive AI cybersecurity company released data on how the issue affected large companies. Cogent reported that an average Fortune 500 company had 2,266 affected properties, with an average of 16 properties requiring immediate action. As of 8 pm ET on Wednesday, Cogent reported that less than 1 percent of affected assets had been compromised.
PHP2Shell causes disruption across the webincluding wikipediaAnd many government, gaming and business websites required emergency maintenance. Most services were restored by Thursday morning.
The PHP Foundation, the nonprofit team behind the PHP coding language, released emergency security updates on Wednesday to fix two critical vulnerabilities, a day after details about the flaws leaked online.
The UK’s National Cyber Security Center (NCSC), the Prime Minister of Japan and the US National Security Agency all urged organizations To install repair Immediately.
A newly exposed PHP vulnerability caused multiple outages on Wednesday as webmasters around the world struggled to update their websites.
What is PHP?
PHP is a programming language that runs on web servers. When you load a webpage, PHP often runs behind the scenes, retrieving data from a database and building the page before it reaches your browser. BleepingComputerNotes It powers many websites, including content management systems, online stores, and custom web services. According to NCSCPHP is also built into a range of other products.
The NCSC says the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow an attacker to run their own commands on a PHP-based server without logging in. This is called remote code execution, and it is one of the most serious types of security bugs.
mashable light speed
According to the NCSC, an attacker can corrupt PHP by overloading its memory, then, under certain conditions, use that corruption to take control of the server. One of the flaws is how PHP processes submissions and file uploads.
PHP rated each flaw 9.2 out of 10 on the industry’s standard severity scale CVSS. Security firm Watchtower described him as a perfect 10, BleepingComputer reports, and so did an anonymous Hacker News post, which has since been deleted. Researchers have begun calling the bugs “PHP2SHELL”.
The fixes were originally planned for a coordinated release later this week, so companies would have time to prepare. Then, information about the flaws was already leaked. Speaking to BleepingComputer, Watchtower CEO Benjamin Harris said the vulnerabilities are “really real” and affect PHP versions 5 to 8. The firm said it has reproduced one of them.
PHP pushed its release to Wednesday at 10 a.m. ET. As of Tuesday, Watchtower said it had not seen anyone taking advantage of the loophole. As of Wednesday, Cloudflare CTO Dan Knecht said on x According to BleepingComputer, the company was looking into the initial attacks.
This tweet is currently unavailable. It may be loading or may have been removed.
The NCSC says organizations running PHP 5 or later are affected and should update to the latest fixed version. Anyone who is still using an older, unsupported version should move to a supported version.
Wikipedia and government websites affected by PHP vulnerability
Wikipedia was briefly down on Wednesday, and the Wikimedia Foundation, the nonprofit that runs the site, confirmed to Mashable that the outage was linked to PHP vulnerabilities.
In a statement to Mashable via email, the foundation said it is working to fix flaws in PHP, which it described as the programming language behind most wikis, including its own projects. “This issue affects all known versions of PHP, and is not specific to the Wikimedia Foundation,” the statement said.
The foundation said all of its PHP-based systems are affected, as well as volunteer-run systems that use PHP. It also took several other systems offline as a precaution until they could be safely patched. As of the time of this writing, Wikipedia has become active again.
PHP Vulnerability: Which Websites and Services Are Affected?
Who else is affected, and what should you do?
If you just browse the web, there’s nothing for you to install. The solution depends on the people who run the website.
If you run a website, blog or online store, check if it uses PHP and make sure it’s up to date. If a hosting company manages your site, contact them to confirm that they have applied the patch.
For organizations, NCSC recommends:
-
Finding every system running PHP, starting with systems accessible from the Internet.
-
Tracking updates from vendors whose products include PHP.
-
Taking systems offline if they can’t be repaired quickly.
-
Checking any systems that could not be updated immediately for signs of break-in.
cloud flare Emergency firewall rules have been added Designed to block suspicious requests involving vulnerabilities. These terms are available to all of its customers, including those on the free plan.
Do you want to learn more about getting the best from your technology? Sign up for Mashable Top Stories & Deals Newsletter Or Receive Mashable Push Alerts Today.