HighII Cyber Warfare & Critical Infrastructure21 October 2026, Wednesday
CISA tells operators to take unpatchable PHP systems offline
On 21 October the US Cybersecurity and Infrastructure Security Agency (CISA) called for urgent patching of 2 critical flaws known as PHP2Shell. It asked organisations that cannot patch, or that run unsupported versions 8.1 and earlier, to take their systems offline.
CISA's 21 October alert says CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution on any PHP installation that responds to web requests. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to The Record, PHP rated both flaws critical at 9.2 out of 10, and patches began rolling out after 10:00 US Eastern time on 21 October.
Sources diverge on exploitation. CISA writes that it had observed no exploitation when the alert was published. According to BleepingComputer, Cloudflare's chief technology officer confirmed early attacks targeting both flaws before the patches were out. The Record says watchTowr saw attempts using AI-assisted proof-of-concept tools but reported that none had yet succeeded.
Scale is the heart of the problem. A VirusTotal estimate cited by BleepingComputer puts the number of internet-facing PHP servers at more than 5.1 million. According to The Record, Detectify says about half of PHP sites run on old versions that no longer receive updates. Hundreds of sites went offline on 21 October, and Nintendo was among the companies suspending services. Countries issuing warnings include the US, Germany, the UK, the Netherlands, Australia and Japan.
Researchers at Calif found the flaws about 2 months ago using OpenAI's tools. A day earlier, on 20 October, CISA had added 6 flaws to its Known Exploited Vulnerabilities (KEV) catalogue, 4 of them in Plex Media Server. One of the 6 is a command injection flaw in the SiteGuard web application firewall, which Japan's national CERT has also reported as exploited.
Talay assessment
Bottom line
PHP2Shell is one of the first large-scale cases in which AI-driven flaw discovery has outpaced the patch cycle. With about half of sites on versions that receive no patches, the risk will be measured in months rather than days. The most likely path is successful exploitation spreading through small, poorly maintained sites, enlarging the infrastructure used for phishing and malware distribution.
Likely effects
- Small business and public sitesNegative1–6 months
Unsupported versions 8.1 and earlier get no patches; these sites must choose between shutting down and being exploited.
- Hosting providersNegativeWeeks
More than 5.1 million exposed servers saddle shared hosting firms with the cost of mass patching and service outages.
- Web infrastructure in TürkiyeNegativeWeeks
Türkiye is absent from The Record's 21 October list of warning countries; local public and e-commerce sites on unsupported PHP versions face the same flaw.
Possibilities, ranked
- 1Widespread but shallow exploitation55%
Successful attacks rise on neglected sites, large organisations patch quickly, and there is no systemic collapse.
Watch: CISA adding the two PHP flaws to the KEV catalogue
- 2A major breach chain30%
Mass compromise occurs through a hosting provider or a widely used content management system, and data leaks are disclosed.
Watch: A large-scale breach linked to PHP2Shell reported by mid-November
- 3Quick closure15%
Patches and temporary WAF rules contain exploitation, and the issue fades within a few weeks.
Watch: watchTowr and Cloudflare reporting no successful exploitation attempts
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Internet-facing PHP servers▲ 5.1m+
- Flaw severity score▲ 9.2 / 10
- KEV additions on 20 October▲ 6 flaws