Two critical PHP flaws, dubbed PHP2Shell, allow an attacker to take control of a web server without a password. On 21 October 2026 at 16h (Paris time), the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix this PHP flaw. In Switzerland, the Federal Office for Cyber Security (FOCS) recommends installing these updates immediately.

PHP is the programming language that runs roughly three out of four websites, including every WordPress site. The flaw therefore affects a municipal website just as much as an SME's online shop. In France, several public websites were taken offline as a precaution on the same day.

What does the PHP2Shell flaw allow?

The two flaws allow an attacker to run their own programs on the server, without any credentials. They are listed as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 on the usual severity scale. The attacker sends a booby-trapped request, and the attack is triggered before the site even processes the request.

The php.net security advisory describes two distinct mechanisms:

  • CVE-2026-109618: when memory runs out, PHP can stop while a request's internal data is only partly ready. The cleanup that follows can then treat this invalid data as valid.
  • CVE-2026-109619: an internal state tied to a request can survive after its memory has been freed. A subsequent request, handled by the same process, can reuse this stale state.

All the common ways of serving PHP are affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers the risk highest with mod_php. It says it has a demonstrated attack in which a single unauthenticated request is enough.

Which PHP update should you install?

The only complete protection is a PHP update to the fixed version of your branch. The table summarises the situation described by php.net and by Journal du Coin.

Installed branchVersion to installNote
PHP 8.58.5.12Supported branch
PHP 8.48.4.27Supported branch
PHP 8.38.3.36Supported branch
PHP 8.28.2.35End of updates on 31 December
PHP 8.1, 8.0 and 7.4No new official versionMinimal patches published by the PHP security team, distributor packages or migration

Linux distributions and long-term support vendors received the patches in advance. On a Linux server, it is therefore often enough to install the package updated by your distributor. For PHP 8.1 and older versions, the project no longer publishes updates, but it has provided minimal patches for those who compile PHP themselves.

Those who cannot update right away have temporary measures available. The PHP project points out that they reduce exposure to certain attack paths, without making an installation safe:

  • disable upload progress tracking (session.upload_progress.enabled=0), then restart every PHP process;
  • lower the maximum size of submitted data (post_max_size): 8M for a site without file uploads, 32M if uploads are needed;
  • remove the memory limit controllable by PHP (memory_limit=-1), in a configuration that applications cannot modify.

Why were public websites shut down in France?

In France, the shutdown is a precautionary decision, not the consequence of an intrusion. The Ministry of the Interior put "all of its exposed websites" into maintenance mode at the request of the National Cybersecurity Agency of France (ANSSI). The websites of the Paris police prefecture and several prefectures, the Ministry of the Economy, Météo-France and Les Echos displayed a maintenance message on 21 October 2026. None of these sites reported an intrusion.

The reason lies in the timeline. Cloudflare, which filters traffic for a large part of the web, was blocking attack attempts as early as 5:02 (Paris time), nine hours before the official release. The company also saw attackers changing their methods to get around its rules. The embargo planned for Thursday had broken on Monday 19 October 2026, after a post on the Hacker News forum.

Other European countries reacted in the same way, according to a Reuters survey cited by Journal du Coin. The German federal agency ITZBund disabled several websites, Finland shut down government web services and, in the Netherlands, the Port of Rotterdam and the Overheid.nl portal were offline.

What does the Federal Office for Cyber Security recommend?

The FOCS published a warning on 21 October 2026. In it, the office describes two critical vulnerabilities that could allow malicious code to be executed on the affected servers, without authentication. The office recommends updating the affected systems immediately.

The FOCS adds a point that is often overlooked: beyond web servers, the applications and devices that use PHP as a built-in component must also be checked. The office also receives voluntary cyber incident reports from the public, businesses and authorities. Operators of critical infrastructure, for their part, have been required to report their cyber incidents to it since 1 April 2025.

What an SME or a municipality should check with its hosting provider

For most hosted websites, it is the hosting provider that manages PHP and must apply the update. One question is enough to start with: "Have you applied the PHP2Shell patch?" Website security then comes down to a few concrete checks, drawn from the recommendations of the FOCS and php.net:

  • list all PHP installations, including those hidden in third-party software: a statistics tool, a forum or an old forgotten website;
  • ask for the installed version and check that it is 8.5.12, 8.4.27, 8.3.36 or 8.2.35;
  • for a site still running PHP 8.1 or older, apply the temporary measures and plan a migration;
  • review the applications and devices that embed PHP, as the FOCS requests;
  • watch for signs of attack: file uploads followed by a series of 500 errors, abnormally large PHPSESSID cookies, PHP processes restarting for no reason.

A site protected by Cloudflare benefits from its blocking rules, which are active on all its plans, including free ones. This filter does not replace the update, since attackers are already adapting their requests. These steps are in line with simple cybersecurity measures: inventory, updates and monitoring.

How an artificial intelligence found the flaw

The bugs had lain dormant in the PHP engine for more than ten years, according to Wiz Research, the cybersecurity company behind the discovery. Its team found the first flaw on 19 August with its Wiz Atlas tool and two AI models, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. The report was sent to the PHP project on 24 August and the acknowledgement of receipt arrived on 21 September.

Wiz claims that "a single researcher accomplished in one week" the work of several months for a top-level team. Raluca Ada Popa, head of Gemini security at Google DeepMind, offers a nuance: AI was also used to validate the patch and to build the detection tools.

What we do not know yet

  • None of the sources consulted reports a successful exploitation in Switzerland, nor a Swiss website taken offline.
  • The number of Swiss websites that are still vulnerable is not known.
  • The scale of the attacks remains unclear: Huntress had seen no real-world exploitation on the evening of 19 October 2026, whereas Cloudflare has been observing some since the morning of 21 October.
  • How long it takes for the shut-down sites to come back depends on the number of servers to be handled: a few hours, sometimes days when business applications have to be tested.

Sources