22.6 million internet-exposed instances may be vulnerable to a pair of critical flaws in PHP, Palo Alto Networks’ Unit 42 told researchers and agencies this week, prompting the NSA, FBI and CISA to urge organizations to update immediately or take affected systems offline.
What the "php2shell" flaws allow
The vulnerabilities, grouped under the label "php2shell," let attackers run commands on a vulnerable server without logging in, the agencies said. Successful exploitation could allow an attacker to steal data, alter a website’s content, or take full control of a site. Researchers demonstrated attacks that read sensitive information from a server’s working memory, including passwords and access credentials, and security company Wiz said it had shown successful attacks against WordPress, Drupal and Joomla installations.
PHP’s developers warned that all installations that handle web requests are at risk and that, under certain setups, an attack can happen before a site’s own code executes — meaning a site can be exposed even if its own application code is carefully secured.
How large the exposure might be
PHP is not a niche component. Web technology tracker W3Techs reports that PHP powers roughly 70% of websites where the server-side language is known, and it underpins major site-building platforms including WordPress, Drupal and Joomla.
Unit 42’s count — more than 22.6 million internet-exposed instances that might be vulnerable — offers one measure of scale. A Nextgov/FCW analysis using Shodan identified roughly 900 results tied to U.S. federal, state and local government websites that showed signs of PHP use; many listed older PHP versions, though the analysis cautioned that Shodan may not reflect recent updates. Separately, some governments in Europe have already taken websites offline to implement fixes.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDiscovery, coordination, and an accelerated disclosure
The response involved a mix of private security firms, the PHP maintainers, and U.S. government coordination. OpenAI said that security firm Calif identified a critical flaw using its GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led development and release of fixes and released updates Wednesday for supported versions.
The U.S. government participated in coordinating the response ahead of disclosure: OpenAI said it and its partners engaged the White House’s Super Intelligence Force, the Office of the National Cyber Director and the Cybersecurity and Infrastructure Security Agency to help get guidance to organizations responsible for critical infrastructure and essential services.
The planned disclosure was accelerated after an early leak. A post on Hacker News surfaced Tuesday morning and was later removed, but screenshots spread on social media, according to cybersecurity firm Huntress. PHP’s developers then announced fixes would arrive a day earlier than planned, compressing the window website operators had to prepare.
What this means for technologists, governments, and website operators
- Technologists and security teams: The agencies’ message is immediate — update PHP to the latest patched version or take exposed systems offline. Organisations using Linux distributions or long‑term support services were advised to check vendors for updated packages that include fixes adapted for older versions.
- Governments and critical‑infrastructure operators: The Nextgov/FCW/Shodan signal and reports of European governments taking sites offline show that public-sector web services are a visible and practical target; the U.S. government also acted as a coordination node to push guidance to operators of essential services.
- Website operators and vendors: Even carefully secured website code can be exposed if the underlying PHP runtime is vulnerable; vendors and hosting providers will need to prioritize patched packages and communicate version updates to customers quickly.
Immediate risks and the compressed timeline
CISA stated plainly: "While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched." At the same time, Trey Darley, founder of Proper Tools, warned that opportunistic attackers do not need to know which systems are vulnerable before probing them: “I’d expect a great deal of opportunistic exploitation: attackers don’t need to know what’s vulnerable before they start knocking on doors,” he said. “Right now, the priority is protecting the systems people actually have.”
The leak and the rapid release of fixes have shrunk defenders’ preparation time. PHP’s maintainers released updates for supported versions, and vendors of Linux distributions and long‑term support services were told to supply adapted fixes for older releases — but the practical task of finding and patching every exposed instance, or deciding which systems must be taken offline, remains immediate and concrete.
For organizations running web services the choice is stark and specific: install the released PHP updates now, check with operating‑system and distribution vendors for backported packages, or remove vulnerable systems from the network until a fix is in place. Whether opportunistic attackers will turn the php2shell disclosures into a wave of exploitation remains to be seen — CISA has not observed exploitation yet, but the leak and the scale reported by Unit 42 make rapid action the rational default.
https://www.defenseone.com/threats/2026/10/critical-flaws-php-warning/416727/
