PHP2Shell and the Case for Knowing What You Run
Just over two weeks ago, PHP shipped emergency fixes for two critical flaws in the language itself. By the time patches landed on October 21, government websites in Australia, France, Finland, Denmark and the Netherlands had gone offline as a precaution. Within days, CISA confirmed attackers were exploiting both bugs.
The flaws, CVE-2026-109618 and CVE-2026-109619, are now known as PHP2Shell. Most coverage has focused on which versions to install, and while that part matters, public sector IT teams are faced with a more lasting question: do you know everywhere PHP runs in your environment, including the systems your vendors manage on your behalf?
What Happened
The bugs had sat in PHP's codebase for roughly 14 years before AI-assisted research surfaced them this summer. Wiz Research, OpenAI and the security firm Calif each found versions of the problem, and PHP planned a coordinated release for October 22. That plan came apart when the CVE identifiers leaked online on October 20, and PHP moved its release up a day.
- August - Researchers discover the flaws and begin coordinated disclosure with PHP
- October 17th - Amazon Threat Intelligence logs an exploitation attempt, four days before public disclosure
- October 20th - PHP warns admins an emergency release is coming as CVE numbers leak early
- October 21st - PHP ships fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and CISA urges organizations to patch immediately
- October 26th - CISA adds both flaws to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until October 29 to fix them
- October 28th - CISA flags a Linux kernel bug nicknamed Fragnesia that attackers are chaining with PHP2Shell
Both flaws carry a 9.2 CVSS v4 rating and allow remote code execution without a login. One can also leak server memory, which often holds passwords, session tokens and API keys. Days later, PHP disclosed a third related bug, though it needs an unusual configuration and will be fixed in a regular release rather than an emergency patch.
Why Government Felt it First
The flaws sit in PHP itself, which effected every website and application built on top of it. A fully updated WordPress, Drupal or Joomla site could still be exposed if the PHP version underneath it was vulnerable. W3Techs puts PHP behind roughly 70% of websites whose server-side language it can identify, including many of the content platforms agencies use to serve the public.
That reach is why government cyber teams moved so quickly. Australia's own national cyber security site went dark the night the patch dropped while fixes were applied. Closer to home, Idaho's state IT agency moved to protect state websites in coordination with federal and local partners. The MS-ISAC rated the threat to large and medium-sized local governments as high, and the League of Minnesota Cities reminded members that a city could be running PHP directly or through a vendor.
A week after the fix shipped, Cybernews counted 10.3 million US-based PHP services still running vulnerable versions. Official patches only cover PHP 8.2 through 8.5, and one scan found nearly half of PHP sites that display their version running older releases with no simple update to install. That gap matters in government, where permitting, records and payment systems often stay in service long after the software beneath them stops getting updates.
What Patching Alone Doesn't Cover
If your team patched in late October, you took the most important step. Security researchers and public sector advisories keep returning to a handful of follow-up checks, and they're worth confirming:
- Find every PHP instance, not just the obvious ones. Containers, cloud images, hosting control panels and vendor appliances can each carry their own copy of PHP (iTWire).
- Get written confirmation from vendors. Hosted websites, utility billing, payment portals and permitting systems often run on infrastructure your team doesn't manage day to day (Smart Cities Dive).
- Review logs back to October 17. Look for unusual POST requests, repeated PHP worker crashes or unexpected processes. Where code execution looks possible, rebuild the system and rotate database credentials and API keys.
State, local, tribal and territorial agencies that want an outside view can also request CISA's no-cost Cyber Hygiene scanning of their internet-facing systems.
The Window Between Disclosure and Exploit is Shrinking
There's good reason to expect more vulnerabilities like PHP2Shell in the months ahead. AI helped researchers find bugs that had gone unnoticed for more than a decade, and OpenAI President Greg Brockman said he expects to find "many more such issues over upcoming months". The same tools can also help attackers turn a thin disclosure into a working exploit, which is part of why the leak became such a race.
For public sector teams, the useful response is less about chasing each headline and more about building the visibility and process that make the next one routine. That means a current inventory of what runs where, monitoring that spots unusual behavior early, and a response plan that names who does what when an emergency patch drops. Agencies with those pieces in place could spend the week of October 21 patching rather than searching for what needed it.
Where Strategic Communications Fits
Strategic Communications works alongside state, local and federal agencies and public safety organizations to build that foundation. Our team helps IT leaders see what's running across on-premises, cloud and vendor-hosted environments, tighten how vulnerabilities get found and fixed, and modernize the infrastructure that makes patching faster next time. The goal is simple: when the next critical patch lands, your team already knows where it needs to go.
Agencies can work with us through contract vehicles including Sourcewell, NASPO ValuePoint and GSA MAS.
Want a second set of eyes on your PHP footprint? Talk with our team.
