Overview
- Maintainers published emergency patches on Wednesday, October 21, and hosting providers and customers moved quickly to apply them so most affected sites could be restored.
- Cloudflare and other security firms reported a jump from thousands to millions of automated exploitation attempts within hours after technical details were made public.
- The vulnerability, labeled PHP2Shell (CVE-2026-109618 and CVE-2026-109619), permits remote code execution, which lets attackers run arbitrary code on vulnerable servers and can lead to full system takeover.
- Numerous universities, hospitals, municipalities and small businesses took websites offline as a precaution; German officials say there are no confirmed breaches of federal systems so far but urge administrators to check logs and verify updates.
- Authorities warn the flaw can affect not just websites but also web interfaces on routers, firewalls, load balancers and NAS, and experts note that AI helped find the bugs while also likely speeding attackers’ exploit development, making ongoing vigilance essential.