“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities rated 9.2 on the CVSS severity scale. The danger matters because PHP runs many websites, including systems built with WordPress. A vulnerable public-facing server can become an attractive target once attackers know how to exploit it.

Remote code execution means an attacker can make the server run commands of the attacker’s choice from another location. The article reports confirmed remote code execution against Apache mod_php running vulnerable PHP 8.4.26. The article does not explain the flaws’ exact technical trigger, so the precise exploit mechanism is not stated here.

Attacks were already underway when the article was published. Cloudflare saw thousands of attempts before public disclosure, then millions afterward. CISA listed both CVEs in its Known Exploited Vulnerabilities catalog, showing that the threat had moved beyond theoretical risk.

The reported exposure is enormous, but the figures come from different surveys and should not be added together. Censys found 32.5 million Internet-facing PHP services showing unsafe versions. It could not determine the PHP version for 61,303,506 services, or 58% of all detected services. That creates a large unknown-security group.

Unsupported versions are a separate concern. Flare found that nearly three quarters of 2.2 million tracked PHP service records advertised a branch no longer supported by PHP’s project. Mallory’s study found about 1.9 million unsupported services among 2.6 million surveyed, or 73.5%.

The counts are imperfect. Linux distributions may backport security fixes without changing reported version numbers, so some services labeled vulnerable may already be patched. Even so, the surveys show widespread exposure, uncertainty, and outdated software across Internet-facing PHP systems.

Patching has been slow because many organizations are not dealing with a simple update. Older PHP branches may be unsupported, meaning no official patch exists for them. Organizations then need to move applications to a supported version, test compatibility, and possibly coordinate with vendors. That work is harder than applying a normal security fix.

The article also highlights measurement uncertainty. Linux distributions can backport fixes without changing visible PHP version numbers, making some systems appear vulnerable. Meanwhile, researchers saw attacks begin, but most organizations did not take systems offline. Wikimedia Foundation and Internet Archive acted, while two PHP-driven games permanently closed.

The result is a gap between awareness and remediation. Ox Security reported 93.6% exposure five days after disclosure. CISA required federal civilian agencies to remediate by October 29, 2026, but ongoing attacks mean delayed upgrades leave valuable systems exposed.

Running unsupported PHP changes the problem from patching to modernization. The PHP project does not provide official patch releases for those branches, so an organization cannot simply install the normal PHP2Shell fix. It must move the system to a supported version or find another supported solution.

That migration can affect the applications running on the server. Ramy Rahman said organizations may need to upgrade applications, address compatibility issues, or work with vendors to obtain supported fixes. These steps can require testing and coordination before production systems are changed.

Until the upgrade is complete, the system remains exposed unless another mitigation is used. The NSA advised organizations to take systems offline if an immediate update was not feasible. The article also describes Wikimedia Foundation and Internet Archive taking action, while two PHP-driven online games closed permanently.

The clearest alternative to an immediate PHP update is removing the vulnerable system from exposure. The NSA advised organizations to take systems offline until they could be fully mitigated when an immediate update was not feasible. This prevents normal Internet traffic from reaching the vulnerable service, but it also interrupts the service.

For unsupported PHP, organizations can work toward a supported version rather than applying a nonexistent official patch. That may involve upgrading applications, resolving compatibility issues, or working with vendors to obtain supported fixes. The article gives Wikimedia Foundation and Internet Archive as examples of organizations that took action.

Some services may choose permanent shutdown instead. Two PHP-driven online games closed down permanently, according to the article. These measures reduce exposure, but they demonstrate the operational cost of responding when attacks are already active and modernization cannot happen immediately.

PHP is a programming language commonly used on web servers to create dynamic pages and handle application logic. Apache is web-server software that receives browser requests and serves responses. WordPress is a website publishing platform built largely with PHP. The article notes that about 70% of websites with an identifiable server-side language use PHP-based systems such as WordPress.

In a typical setup, a browser requests a page from Apache. Apache passes PHP work to the PHP runtime, which executes the application code. WordPress then retrieves content and settings, builds the response, and sends it back through PHP and Apache. The article specifically mentions Apache mod_php, a configuration in which Apache runs PHP code.

A vulnerability in PHP can therefore affect many websites and server configurations. The article reports confirmed remote code execution against Apache mod_php running vulnerable PHP 8.4.26. The exact PHP2Shell exploit path is not explained in the source.

Security companies measured PHP2Shell exposure in different ways. Censys counted Internet-facing PHP services and recorded reported versions, while warning that backported fixes can make version data misleading. Flare and Mallory surveyed service records to estimate how many systems used unsupported PHP branches. These methods reveal scale, but they do not prove every apparently vulnerable service is exploitable.

Researchers also watched attacks directly. Adel Karimi reported confirmed remote code execution in a honeypot running Apache mod_php and vulnerable PHP 8.4.26. Cloudflare monitored exploit attempts across its network. Matthew Prince said attempts rose from thousands before disclosure to millions afterward.

The NSA advised updates and offline systems when updates were impossible. CISA added both CVEs to its Known Exploited Vulnerabilities catalog and made remediation mandatory for US federal civilian agencies by October 29, 2026. Together, measurement and official requirements push organizations toward faster mitigation.