PHP2Shell flaws prompt website shutdowns worldwide as attackers tried exploits days earlier

Attempts began days before disclosure

Amazon Threat Intelligence says attackers tried to exploit the flaw on 17 October, four days before the bugs became public. The attempt was caught by MadPot, a decoy system Amazon uses to lure threat actors and study them, and it came from an IP address linked to a commercial anonymization network. On Wednesday, 21 October, Amazon also identified several proof-of-concept exploits and further attempts from other anonymized infrastructure, which it said pointed to more than one actor. Cloudflare separately warned of early attacks against PHP sites on its platform, even though at first no exploitation of either flaw had been reported. Malicious activity did not stop after the fix was published.

The term Black October has started circulating online, while whether attackers have used the bugs against targets is still unclear.

The flaws and who found them

The PHP Project published the two flaws, CVE-2026-109618 and CVE-2026-109619, on 21 October and released an urgent security update the same day. ZDNet reports that each carries a critical severity score of 9.2 and that they affect most PHP builds. Wiz's security team found the bugs with the help of AI, and ANSA reports that the weakness had remained hidden in systems for more than a decade. Wiz also says PHP can be found on 70% of the world's websites, and it described the exposure in direct terms:

These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it.

The researchers said that building the attack chain required an exceptionally complex sequence of steps, at the edge of what human researchers could practically achieve, but that frontier AI models substantially reduced that barrier.

Services shut down across sectors

Adnkronos reports that the flaws led to precautionary shutdowns of websites and essential services, including banking, airlines, trains and government services, from Tokyo to Helsinki. In Japan, Mitsubishi UFJ Financial Group and the brokerage Nomura suspended web pages and access to digital services for several hours for urgent maintenance, SAPO reports. Ministries, courts, health networks and social security portals in several European countries also suspended public traffic temporarily. In the Netherlands, government websites went offline as a precaution on Wednesday, and hospitals could not be reached through their websites. Adnkronos adds that Japan, France and South Korea adopted emergency measures, suspending online services and raising cybersecurity alert levels.

Guidance and what users can do

Guidance from CERT-EU, Portugal's Centro Nacional de Cibersegurança and the US CISA tells organisations that cannot apply patches immediately to take affected systems off the internet, SAPO reports. Europa Press adds that CERT-EU advised isolating internet-facing applications from public networks until a fix is available. The Independent reports that only the operators of affected websites can fix the flaws directly. Emily Austin, principal security researcher at Censys, said that end users can do little beyond hoping the services they rely on do not use PHP or are being patched, and she recommended unique passwords for each site. Dan Guido, CEO and co-founder of Trail of Bits, advised people to turn on automatic updates for their phones, computers and home routers.

You can't patch your hospital's website.

Guido said most of the work falls on companies running services, which need to deploy fixes faster and limit the damage that compromised systems can cause.