Attackers exploiting the PHP2Shell vulnerabilities broke into a government organization in Europe and, within two hours of getting in, "had successfully accessed password hashes" and multi-factor authentication secrets, researchers at Palo Alto Networks' Unit 42 threat-intelligence team reported, according to The Hacker News on October 25. Profoundd found no earlier publicly reported confirmed compromise through the flaws since PHP released fixes on October 21. Until now the evidence had been of attempts: Amazon, Cloudflare and the security firm watchTowr reported exploitation attempts, while the PHP project's security team said it "did not identify any functional exploits" among the proof-of-concept code circulating at release, and the U.S. Cybersecurity and Infrastructure Security Agency said on October 21 that it had not observed exploitation. As of October 23 the flaws were not yet in CISA's catalog of known exploited vulnerabilities, according to Tenable.
What PHP2Shell is
PHP is the programming language behind a large share of the web, including WordPress, Drupal and Joomla sites. PHP2Shell is the name for two memory-safety flaws in the PHP interpreter itself, tracked as CVE-2026-109618 and CVE-2026-109619, that can let an attacker who is not logged in run code on a server. PHP's security team rates both 9.2 out of 10 on the CVSS 4.0 severity scale. They affect PHP versions going back to 5.4. Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; versions 7.4 through 8.1 have only source-code patches from the PHP security team, and versions before that are out of support with no fix from the PHP project. Amazon says "upgrading is the only complete remediation" and that no configuration change alone fully addresses both flaws. The bugs were found by the security firms Calif and Wiz, both of which said they used AI models in their research.
Exploited before the patch
Amazon's threat-intelligence team said it found an attempt to exploit the flaws against its MadPot decoy servers dated October 17, four days before public disclosure, from an address tied to a commercial anonymization network. Amazon said it "remains unclear how the actor acquired exploit information prior to disclosure," and also that "it's unclear if any of these attempts would have succeeded in real-world systems." The vulnerability identifiers leaked on October 20, and the PHP Foundation moved its release up a day. Because of the early attempts, Amazon advises organizations to start any investigation from October 17, not from the disclosure date, and to look for unexpected processes or changed files on web servers. In practice, a server patched on October 21 may still have been reached before then.
Governments treated the disclosure as an emergency. The U.K.'s National Cyber Security Centre told organizations to update PHP servers immediately or take them offline until they could, and the EU's computer emergency team gave similar advice. Among the services taken offline as a precaution, according to Wikipedia's running account citing Reuters and the BBC, were the Dutch government portal Overheid.nl, Finland's public-facing government web services and all websites of France's Interior Ministry; some Canadian government sites went down temporarily on the advice of Canada's cyber centre. The U.S. National Security Agency also urged sites to go offline if they could not update.
What has happened since
Unit 42 said the attackers in the European case set up a relay tunnel into the victim's Active Directory, the system that manages its user accounts, and tried to gain domain-administrator rights, and that the commands showed signs of an AI agent driving the intrusion, including output formatted "for an AI model to read." The firm CYFIRMA reported a separate, deliberately slow scanning campaign probing 216 unpatched or partly protected servers across the U.S., Asia, the Middle East and Europe from 21 compromised machines, which it attributes with "moderate confidence" to an operator linked to North Korea's Lazarus Group; that attribution has not been confirmed by any government. Cloudflare said it has seen "millions of exploitation attempts" since disclosure, and the firm VulnCheck said attempts to install a version of the Mirai botnet malware have so far failed. Bitsight counts nearly 37 million internet-facing systems running PHP or PHP-related software; more than a million PHP servers were still running unpatched releases as of October 21, according to VulnCheck and Censys data. The PHP Foundation has also warned of a third remote-code-execution flaw, CVE-2026-115560, which it says requires "an unusual combination of configuration and application code" and will be fixed in a regular release.
The rest of the week's disclosures
PHP2Shell landed in a cluster of serious disclosures that some security writers have taken to calling "Black October." On the same day, October 21, the makers of the BIND, PowerDNS and Unbound DNS resolvers, the servers that translate web addresses into numeric addresses for internet providers and companies, shipped fixes for flaws that could crash them, in specific cases let attackers plant false answers in their caches, or, in one BIND bug under narrow conditions, corrupt memory; the Internet Systems Consortium said it knew of no active exploits of the BIND flaws. Node.js, the widely used JavaScript server runtime, fixed ten vulnerabilities, including a flaw in its bundled Brotli decompression code that could allow remote code execution; no exploitation has been reported. Also on October 21, attackers compromised the release process of LiteLLM, a popular open-source tool for AI applications, and published a malicious version, 1.107.0, that targeted credentials and API keys. A week earlier, on October 15, a critical Linux kernel flaw dubbed PwnEscape (CVE-2026-99999) was disclosed that can let code inside a cloud virtual machine read the host's memory or crash it.
For site operators, the advice from Amazon, the NCSC and others is the same: update PHP now, and treat any internet-facing PHP server as possibly compromised until logs back to October 17 have been checked. For everyone else, there is little to do about a website's server, but the standard precautions after a wave of breaches apply: change passwords that are reused across sites, turn on passkeys or app-based two-factor authentication where offered, and watch for breach notifications.
This article reflects reporting through the evening of Sunday, October 25, 2026. Sources: The Hacker News, October 25; AWS Security Blog, October 21; Tenable, updated October 23; Wikipedia, "PHP2Shell" and "Black October (information security)"; LinuxSecurity, October 22; The Hacker News on Mirai attempts; The Hacker News on PwnEscape, October 15.
