PHP2Shell attacks began at least four days before the fix. The two flaws sat in PHP itself, a layer underneath much of the web, so even carefully built sites could be exposed. Every AI chat app runs on layers like that too. You can’t patch them, but you do decide what you paste.

On October 17, the earliest attempt Amazon saw hit one of its honeypots, the decoy servers it runs to draw attackers in. When PHP shipped the fix on October 21, Cloudflare counted tens of thousands of attempts within the hour and millions by early the next day. For all that noise, no break-in at a real organization had been confirmed as of October 26. The only confirmed working attacks were on one researcher’s own decoy servers.

Checked on October 26, 2026. The story is still moving, so follow the links before you rely on any number.

Run a site on PHP? Skip to what to do.

The flaws reach back to PHP 5.4

PHP runs a large part of the web, every WordPress site included. PHP2Shell is the name for two flaws in it, CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 out of 10, and they turn up in nearly every PHP version since 5.4.

Either one can let an attacker run code on a web server without logging in. The flaws can also let an attacker read the memory of the PHP process that handles requests, which may expose passwords, login tokens and API keys from other visitors’ requests.

Researchers at Calif, Wiz and OpenAI are credited with finding them. PHP released fixed versions on October 21 (8.5.12, 8.4.27, 8.3.36 and 8.2.35) and didn’t soften its advice. “There are no complete mitigations,” the project wrote, “updating is the only safe choice.”

Millions of attempts, and no confirmed victim yet

Details leaked on October 20, and PHP pulled its release forward by a day. Once the patch was out, Cloudflare’s count passed hundreds of thousands within two hours.

Most of it was scanning, according to Cisco Talos. Some attempts tried to pull servers into a botnet built on Mirai, malware that floods targets with traffic. Sophos analyzed a sample.

Very little of it worked, at least at first. By October 23, Previdian had seen no successful code execution, and Sansec reported that the public exploits don’t work on a default PHP installation without specific server conditions. Then, on October 24, security researcher Adel Karimi’s decoy servers recorded 35 shells, meaning the attacker could run commands. Karimi ran them in a setup deliberately favorable to the attack, and he says the result doesn’t show how reliable the exploit is anywhere else.

On October 23, Palo Alto Networks’ Unit 42 linked an attack on a European government agency to PHP2Shell, the only public claim of a real victim so far. Two days later it took the claim back, saying it couldn’t confirm the attackers got in through these flaws.

Plenty of organizations didn’t wait to find out. BambooHR paused its HR service for about six hours, some Finnish and Dutch government services went dark, and the UK government said 32 of its digital services were unavailable. None of those shutdowns was tied to a confirmed break-in.

You can’t patch the servers your words pass through

With PHP2Shell, a site’s developers could do everything right and still be exposed, because the flaws sat in software they never wrote. The same goes for any online tool you paste work into. Anything you send to it is only as safe as layers you’ll never see.

Attacks are also getting cheap to run. On October 19, Reuters reported that one operator had used AI agents to attack more than 1,200 websites starting September 25, mostly online stores, and had broken into more than 100 of them. Snorre Fagerland of NorForge, the researcher who found the campaign, estimated about $50 of AI usage per successful break-in, with successful attempts averaging just under 23 hours of agent work.

NorForge checked one of those break-ins itself. By the agent’s own notes, it got in by chaining several weaknesses, including unsafe PHP code and an out-of-date PHP framework. The costs are Fagerland’s estimates, and Reuters couldn’t tell how much data, if any, was taken.

Old flaws and new ones now get tried everywhere. Most of those attempts fail, but the ones that succeed reach whatever the server holds.

You still choose what you send, and who holds it

An AI chat app is a website too. Paste a contract, a client list or a doctor’s letter into one, and it travels through servers like these and usually ends up in your chat history.

The simplest habit is to send less. If the task doesn’t need names, account numbers or addresses, leave them out. A contract summary works just as well with “Client A”.

Every AI app you use keeps its own history, so each one is another company to check and another history to clean up. That includes an app that connects you to several models. It’s still a company holding your chats.

Ask each one four questions. Does it train on your chats, and how long does it keep them? Can people at the company read them? Does it use them for ads?

If you’d like one app for the leading AI models, try Emerge.ai free.

If you run a site on PHP

  • Update PHP on every server to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release in the same line, or install a package from your host or operating system that names both CVEs.
  • PHP 8.1 and older won’t get a new official release. PHP has published source patches for 7.4, 8.0 and 8.1, and some hosts and Linux distributions ship patched packages, so ask yours, or move to a supported version.
  • If you’re investigating, Amazon suggests starting from October 17, the first attempt it saw, rather than from the day of the fix.
  • PHP disclosed a third flaw, CVE-2026-115560, on October 23. It needs an unusual setup and will be fixed in a regular release. Until then, PHP advises setting session.upload_progress.enabled=0 in php.ini and restarting PHP.

What we couldn’t confirm

  • Whether PHP2Shell has broken into a real organization. As of October 26, the confirmed code execution was on a researcher’s decoy servers, and Unit 42 had withdrawn the one public claim.
  • The Reuters campaign’s numbers. The costs are NorForge’s estimates, NorForge checked only one break-in itself, and how it got in comes from the agent’s own notes.
  • When the flaws were first reported to PHP. Reports give different dates in August, so we left it out.

Where Emerge.ai fits

Emerge.ai is our private AI app. Emerge.ai connects you to the models, so you don’t need separate accounts with each AI company.

Data is never used for training.

No app can promise immunity from the next PHP2Shell, and that includes ours. Ask us the same four questions you’d ask anyone else, then start free.

Sources