Most reports said PHP developers had released emergency fixes for two critical security flaws, while a Vietnamese report published on October 23 said the official patch was still awaited; governments and companies worldwide were meanwhile patching systems and suspending online services on October 21–22. Banks, airlines, rail operators and public agencies were among those restricting access while securing their websites.

The vulnerabilities, collectively called PHP2Shell, could let attackers run code on vulnerable servers without logging in. Cloudflare, a provider of internet infrastructure and security services, said attempts to exploit the flaws had reached millions.

Attack attempts began before public disclosure

Cloudflare chief executive Matthew Prince said the company detected thousands of attempts during the 10 hours before public disclosure. That rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours and subsequently millions.

Amazon's threat intelligence team recorded an attempt against its MadPot decoy systems on October 17, according to a technical account on the developer platform Dev.to. That places attempts before the emergency patching effort.

Advertisement

The flaws are identified as CVE-2026-109618 and CVE-2026-109619. Both carry a severity score of 9.2 on the CVSS v4.0 scale, according to the same technical account.

Disruption stretches from Japan to Finland

In Japan, brokerage Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway temporarily suspended some online services. The finance ministry, weather agency and tax agency also restricted services while implementing security measures.

France's Orange suspended access to some PHP-based websites and applications across several subsidiaries as a precaution. Other precautionary restrictions were reported at public bodies in Finland, the Netherlands and Britain, the Wikimedia Foundation and Berlin's Charité hospital.

Finland's state IT services provider, Valtori, said it installed patches overnight and was gradually restoring public services. It said the shutdowns were not caused by a breach or exploitation of the vulnerabilities, and it knew of no active exploitation.

China's industry ministry urged organisations and users to inspect their systems and update PHP. South Korea raised its private-sector cybersecurity alert level and activated emergency response measures.

Updating a website alone will not fix PHP

PHP is a programming language used behind the scenes to process information and generate website content. The flaws sit in PHP itself, rather than in website-management software such as WordPress. Updating that software alone does not repair the underlying vulnerability.

Researchers at security companies Calif and Wiz used artificial intelligence tools to help identify the flaws. The vulnerable code had remained in the software for years.

Updating PHP is the only complete fix, according to the technical account on Dev.to. It cited advice from CISA, the US cybersecurity agency, to take systems offline if they could not be patched. Temporary measures, including disabling a feature that tracks upload progress, are not a confirmed replacement for patching.

The scale of successful intrusions remains unclear. Dev.to said that, as of October 22, no compromise of a named organisation had been publicly confirmed.