PHP2Shell: How Governments Responded to the PHP Flaws

Short answer: after serious flaws in PHP (reported under the name PHP2Shell) went public, governments warned organizations to stay alert, some public websites were taken offline while they were fixed, and hacking attempts reportedly rose. If your site runs PHP, update to a patched version today. The version list and steps are in our PHP patch guide.

What was reported

• The flaws: news coverage describes two PHP flaws that could let attackers take over servers, steal data or deface sites. The PHP Foundation released patches on 21 October 2026.
• How they were found: coverage says AI tools helped uncover them, and that several security groups found parts of the problem around the same time in August. Details such as how long the flaws existed differ between outlets.
• Scale: headlines say the issue could affect around 70 percent of websites, because PHP runs a very large share of the web. Treat that as a headline figure, not a measured count.
• Rising attacks: NPR reports that hacking attempts rose after the flaws became known.

How governments responded

• The US National Security Agency told organizations using PHP to maintain heightened awareness over the coming weeks.
• The FBI reportedly recommended that operators take websites offline if they cannot update right away.
• Government sites in France, Denmark, Finland and the Netherlands, including the Dutch cyber security agency, were reportedly taken offline temporarily while fixes were applied.
• Japan's Chief Cabinet Secretary said the government had received no reports of damage from attacks tied to the flaws.

What a small site owner should do

Step 1: check your PHP version

Look in your hosting panel, or run php -v over SSH. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Step 2: update, or ask your host

On shared hosting, switch to a patched version or ask support to confirm the fix. Restart PHP-FPM or Apache afterwards so the new build loads.

Step 3: if you cannot update today, limit exposure

Ask your host about a temporary shutdown or a firewall rule, as the FBI advice suggests. Do not leave an unpatched site running just to keep it online.

Step 4: check for signs of abuse

Look for PHP files you did not upload, new admin users and unusual scheduled tasks. Keep a recent backup (see website backups).

Common mistakes

• Updating plugins and assuming PHP itself is fixed (see outdated CMS plugins).
• Updating PHP without restarting the web server.
• Treating the 70 percent figure as exact, or as a reason to panic.
• Ignoring the issue because the site is small. Attackers scan for unpatched servers automatically.