Hackers Are Exploiting the Flaws Behind Major Internet Outages, CISA Warns

The website you use to read the news, shop online, or manage your accounts could be running on vulnerable PHP software. Hackers are now exploiting critical flaws in the technology, potentially giving them control of unpatched servers without needing login credentials.^[1]

The threat is serious enough that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given federal agencies just three days to patch the flaws. With PHP powering around 70% of websites, millions of sites could be at risk if their administrators fail to act.

Here’s what you need to know about these PHP vulnerabilities, the risks they pose, and how to protect your website from potential attacks.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

Two critical PHP flaws put web servers at risk

Two critical flaws in PHP, nicknamed PHP2Shell, are now being used by attackers to break into servers that haven’t been updated. The vulnerabilities allow malicious parties to run their own commands on someone else’s server, a technique known as remote code execution.

The attackers don’t need any privileges, such as a password or login credentials. The flaws are being tracked as CVE-2026-109618 and CVE-2026-109619.

It all started around October 20, when the PHP security team warned administrators that an emergency fix was coming. However, before the fixes were ready, details about the flaws leaked online along with sample attack code. The PHP team said that none of the leaked code actually worked, but attackers now knew where to look.

According to Amazon security researchers, attackers had begun probing for the flaws four days before the patches arrived on October 21. Major security firms like Cloudflare, Amazon, and Patchstack observed a wave of attack attempts but reported that all of them were unsuccessful.

However, over the weekend of October 24 and 25, Adel Karimi of Perplexity said that his team’s honeypot recorded a successful break-in on a system running PHP version 8.4.26. Honeypots are decoy servers set up to attract and observe attackers. Karimi’s findings underlined that the flaws had moved from theory to real-world exploitation.

On Monday, October 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities (KEV) list. The KEV list is reserved for security holes that are confirmed to be used in real attacks. CISA ordered federal civilian agencies to patch the systems by Thursday, October 29. Although the order legally applies only to government agencies, CISA urged every organization to treat the flaws as a priority.

Separately, on October 23, PHP also disclosed a third, separate flaw (CVE-2026-115560) that could allow attackers to execute code on a server. This one, however, has no fix yet, and only temporary workarounds are available. Unlike the earlier flaws, the third flaw only affects servers with an unusual combination of settings and code, so far fewer systems are at risk.

What hackers can do with a compromised PHP server

The PHP ecosystem powers around 70% of all websites, and more than 5 million PHP servers are exposed to the internet. Not every one of them is vulnerable, but even a small share of that number gives attackers an enormous pool of targets.

The type of flaw makes the risk even higher. Remote code execution allows attackers to effectively take control of a server without needing to log in. They could steal customer data, such as names, email addresses, passwords, and credit card details. This stolen information could also be used to target individuals with highly convincing phishing attacks, identity theft, and financial fraud.

They could even plant malware that infects visitors to the sites, install ransomware that locks owners out of their own systems in exchange for a ransom, or use those servers to launch attacks on others.

How to protect your website from PHP2Shell attacks

If you’re a website owner, the first thing you should do is check your PHP version and compare it against the patched versions listed in PHP’s official October 21 advisory. Here’s a list of affected and fixed versions.

Make sure you update to the recommended PHP version immediately. Don’t postpone it, as researchers have already observed exploitation in the wild.

Other content management platforms like WordPress, along with their plugins and themes, also have their own updates. Patching PHP while still running outdated plugins leaves you vulnerable to other security flaws.

As for ordinary internet users, there’s nothing to install on your own devices since this is a server-side problem. Even so, make sure you use unique passwords on every site so that even if one site is compromised, your other accounts stay safe. You can use a reliable third-party password manager for this.

Additionally, beware of unusual emails or password reset notices from the sites you use, as these could be phishing messages. Also, turn on two-factor authentication (2FA) wherever available.

The bottom line

PHP2Shell is not a hypothetical threat. Attackers started probing for these flaws before a fix existed, and they’re now breaking into servers that haven’t been updated. The patches PHP released on October 21 close that door, but only on servers where they have been installed.

If you run a website, update PHP to the latest patched version, along with your content management system, plugins, and themes. If your site uses PHP 8.1 or older, there’s no official fix from the PHP project, so upgrading to a supported version is the safest option. Keep an eye out for further updates in the coming weeks.

#1 Password Vault for Seamless Data Security

4.9

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On NordPass's website

2026 Editors’ Choice

Best VPN-Bundled Password Manager

Password Manager

NordPass

BLACK FRIDAY: Get NordPass Premium at 53% Off + 3 Extra Months

• Trusted password manager that also supports passkeys, a more secure way to log in that doesn't rely on a password
• Premium plan adds data breach alerts, email masking, and emergency account access for a trusted contact
• Included in Nord's Plus bundle alongside NordVPN, anti-malware, and an ad blocker

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news