PHP2Shell: PHP Foundation Says It Is 'Incredibly Under-Funded' With One Full-Time Employee; Still No Confirmed Wide Compromise

Updated October 26, 2026: The PHP Foundation describes how small its staff is and says it has no evidence of exploitation before disclosure or on patched sites, and OpenAI's chief executive says patching alone can no longer keep up. CISA's catalogue still does not list either CVE. The new section directly below covers this; earlier updates follow unchanged.

October 26: the foundation behind PHP says it is under-funded#

The PHP Foundation, the nonprofit that supports the language, has "one full-time staff member (that's me) and 14 mostly part-time contractors," Executive Director Elizabeth Barron told Reuters by email on Friday, October 23. Its board members are unpaid volunteers and its funding comes from donations and grants, Reuters reports. "Given that reliance, it is clear that PHP is incredibly under-funded," Barron said.

Barron said the foundation had no evidence that attackers exploited the flaws before they were disclosed, or on sites that have been patched, even as Cloudflare has reported millions of attempts. The foundation works with OpenAI, Wiz and Calif to investigate flaws and coordinate fixes, including this week's patches, Reuters says. Barron said the project now receives nearly twice as many proposed code changes as a year ago, "yet the number of contributors hasn't doubled."

Separately, OpenAI chief executive Sam Altman told students at Stanford Graduate School of Business, "I no longer think we're going to be able to just patch all the bugs," Gizmodo reported on October 23. He said the cybersecurity problem is still something organisational leaders and countries have not taken seriously; Gizmodo's report does not tie the remark to PHP.

CISA's Known Exploited Vulnerabilities catalogue, version 2026.10.23, still had no entry for CVE-2026-109618 or CVE-2026-109619 when we checked on October 26. The PHP project's advisories for the two flaws are GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

Limits of the October 26 update#

• Barron's statements come from a single Reuters interview, which we read via CNA; we did not find a second outlet with her remarks.
• Reuters' figure that PHP "may underpin up to 70 per cent of sites" is an estimate, not a measured count.
• The foundation's lack of evidence does not rule out exploitation it has not seen; our earlier updates below cover vendor reports of attempts.
• We have not seen video of Altman's Stanford remarks; the quote is Gizmodo's.

Updated October 24, 2026: Researchers now describe botnet attempts against PHP2Shell and public exploit code that mostly fails, and Mandiant's CTO says there is no current evidence of successful widescale exploitation but that limited exploitation may have begun. CISA's exploited-vulnerabilities catalogue still does not list either CVE. The new section directly below covers this; earlier updates follow unchanged.

October 24: botnet attempts, mostly broken exploits, and still no confirmed wide compromise#

Three days after the patches, the gap between PHP2Shell's severity and its observed impact is still wide, but researchers are no longer ruling out limited real-world use. Cybersecurity Dive reports that researchers have found activity from Potassium, a Mirai-derived botnet first discovered in March. Arctic Wolf told the outlet it saw one exploitation attempt but did not find enough evidence that its follow-on payload was downloaded or run. Sophos, whose correction is covered in the October 23 section below, said it blocked a Potassium-linked attack.

"So far, though, the reality has been less dramatic than the headlines," Justin Moore, director of adversary operations at Arctic Wolf, told Cybersecurity Dive. Researchers at VulnCheck said most public exploits depend on a PHP setting that is not commonly enabled in real deployments, so they do not lead to a compromise. "We've looked at PHP2shell exploit attempts, and the 'best' ones thus far have been ported from the public PoCs, while others are garbage or nonfunctional," Spencer McIntyre, VulnCheck's director of exploit development, told the outlet.

Mandiant CTO Charles Carmakal said in a LinkedIn post, as quoted by Cybersecurity Dive, that there is no current evidence of successful widescale exploitation and that many proofs of concept in circulation appear to have been "vibe coded" and cannot achieve remote code execution. Cybersecurity Dive reports that Google and Mandiant researchers validated some proofs of concept "capable of RCE against default deployments of mod_php, but not PHP-FPM." "Nonetheless, exploitation may have already begun in a limited fashion, and the threat is viable and very serious," Carmakal said. He recommended upgrading to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restarting web services, and the outlet adds that defenders should rotate keys and passwords on internet-facing systems exposed before patching.

The wider alarm has not faded. CNBC quoted Anthropic deputy chief information security officer Jason Clinton, who wrote that the security landscape is likely to get "a lot worse" before it gets better, and former CISA director Chris Krebs, who urged smaller companies to scan constantly, patch fast or take legacy systems offline. CNBC also quoted a post by John Milinovich, a senior director of product management at Figma, claiming "several dozen cyber attacks" in two days that would each have been the worst of a calendar year. That claim is his, it is not specific to PHP2Shell, and we have not been able to verify it.

What we checked: CISA's Known Exploited Vulnerabilities catalogue, version 2026.10.23 (released 19:30 UTC on October 23, 1,756 entries), still did not list CVE-2026-109618 or CVE-2026-109619 when we checked it at 03:06 UTC on October 24. Amazon's October 22 statement that the flaws are "broadly exploited," in the October 22 section below, remains unverified.

Limits of the October 24 update#

• The Arctic Wolf, VulnCheck and Mandiant statements reach us through Cybersecurity Dive. We did not open Carmakal's LinkedIn post or the firms' own write-ups.
• "No current evidence of successful widescale exploitation" is not the same as no compromises; Carmakal himself says limited exploitation may have begun.
• The absence of a KEV listing means CISA had not added the flaws as of that version; it is not proof that no exploitation has occurred.
• Krebs' figure that 3% of all critical vulnerabilities ever discovered were found in the last month, quoted by CNBC, is his own and we did not check it.

Updated October 23, 2026: Security firms report exploitation attempts but no confirmed compromise from PHP2Shell, and Sophos has corrected an earlier report of a successful exploitation. Amazon's statement that the flaws are "broadly exploited," reported in our October 22 morning update, now carries a dated note there marking it as unverified. The new section directly below covers this; the earlier updates and the original report follow unchanged apart from that note and two short qualifiers in the morning update.

October 23: exploitation attempts, but no confirmed compromise#

On the evidence published so far, PHP2Shell has produced scanning, failed attempts and a large pile of proof-of-concept code, not confirmed break-ins. NBC News reports that researchers and spokespeople at nine companies (CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos and Trail of Bits) said that as of Thursday evening, October 22, they had not seen any successful attacks. "We have not yet seen these PHP vulnerabilities exploited in the wild yet," Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks' Unit 42, told NBC. She said Unit 42 had seen "over 200 examples of proofs-of-concept exploit code" and was investigating them all.

Don Smith, vice president of threat research at Sophos, told NBC that "we have only seen a couple of real exploitation attempts" and that the bugs could be "a slow burn" because they appear harder to exploit than first thought. Dan Guido, chief executive of Trail of Bits, told NBC it took one of his employees, a 10-year veteran, an entire day to hack the vulnerabilities with an advanced AI model. "A lot of people are confusing proof of concept with exploit," he said. Cloudflare chief executive Matthew Prince told NBC that none of the company's customers had been affected, while warning that "something could have gotten compromised very quietly."

Sophos' own advisory shows how quickly the picture moved. An update it timestamped 16:18 UTC on October 22 reported one successful exploitation in customer environments; a correction at 21:21 UTC says customer telemetry shows "scanning and a small number of failed exploitation attempts" and "no evidence of a successful compromise." Sophos says the payload in that attempt, which it describes as a likely variant of the Mirai botnet, was never delivered because its countermeasures blocked the attempt. It says its Adversary Group is finding a working exploit "challenging even with AI support," and that urgent patching remains its primary recommendation. Sophos publishes indicators with the advisory; Times of AI is not reproducing them.

Not every authority is standing down. The Dutch National Cyber Security Centre (NCSC) said in an update at 16:00 local time on October 22 that it is investigating "first signals of successful abuse" and that the situation could worsen quickly because proofs of concept are known (our translation from Dutch). It says several websites that went offline are back, and it advises keeping systems that are still vulnerable offline until they are patched. Amazon, whose October 22 assessment is in the morning update below, also said it was unclear whether any of the attempts it logged would have succeeded against real systems, NBC notes.

For operators, the advice has not changed: every source above still says to patch now. What has changed is the evidence for successful use of the bugs, which none of the sources we opened yet supports.

Limits of the October 23 update#

• NBC's account reflects what nine firms told it as of Thursday evening US time. It is not a census of compromised systems, and Prince's warning about quiet compromises applies.
• The NCSC does not describe its "first signals," and we found no public confirmation of them. Its update is in Dutch and is summarised in our translation.
• Sophos' 16:18 and 21:21 times are its own UTC labels. We did not reproduce its indicators.
• We did not re-open the SANS Internet Storm Center or Japanese and Korean sources from the afternoon update for this update.
• What we checked: CISA's Known Exploited Vulnerabilities catalogue, still at version 2026.10.21 when checked at 03:08 UTC on October 23, did not list either CVE.

Updated October 22, 2026 (afternoon): Japanese banks paused some online services as a precaution, South Korea issued a cyber "Caution" alert, and the PHP Foundation and Chainguard gave conflicting accounts of how the embargo broke. The new section directly below covers this; the morning update and the original October 21 report follow unchanged.

October 22 afternoon: Asian banks pause services, and PHP and Chainguard dispute the embargo#

The response to PHP2Shell has spread from web hosts to banks and national alert levels in Asia, though the bank measures reported so far are precautions, not breaches. Jiji Press reports that MUFG Bank said on its website on Thursday, October 22 that it had halted some transactions through its online banking service, and that Mizuho Bank and Daiwa Securities were conducting emergency maintenance. Several regional banks also stopped some services, among them apps that let customers check balances, according to Jiji. The Japan Bankers Association confirmed there had been no impact so far on the online network for fund settlement that connects almost all domestic banks, Jiji reports.

Japan's Information-technology Promotion Agency (IPA) published an alert on October 22 telling operators that cannot put effective interim measures in place to decide whether they need to block outside access or temporarily suspend services, weighing the likely damage and the effect on their business (our translation from Japanese). In South Korea, the Ministry of Science and ICT issued a cyber crisis "Caution" alert for the private sector effective noon on October 22, after a crisis assessment meeting with the Korea Internet & Security Agency, The Asia Business Daily reports. Minister Bae Kyunghoon said "the usual vulnerability management cycle under which systems are manually checked and patched within a few days is not enough to defend against attacks," calling automated response systems essential. The SANS Internet Storm Center said the flaws are already being exploited and moved its Infocon threat level to yellow.

The embargo, by each account#

The PHP Foundation's account, published on October 21, describes several leaks. It says the two CVE IDs began circulating on forums and social media at around 15:00 UTC on Tuesday, October 20, with a wrong release time and a wrong CVSS score of 10.0, but without technical details. It says Calif, one of the firms that reported the bugs, then "mistakenly published a video" of its proof of concept working against a number of targets, and that mitigation advice the Foundation began giving a few critical-infrastructure providers at around 23:00 UTC that day "may have leaked as well." Its sharpest charge is against Chainguard: "On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix." The Foundation says any attacker could then study the fix in binary form while other PHP users waited. It also calls its own months-long delay in fixing the out-of-memory problem, whose first signs a contracted PHP core developer found in 2024, "a structural failure."

Chainguard chief executive Dan Lorenc told The Register that the company "didn't leak," and The Register says he does not dispute the timeline. He said Chainguard learned "something was coming in PHP" on Friday, October 16 from one of the researchers who found the bugs, and that he and his team then independently found the same memory-corruption vulnerabilities using the company's AI harness and a frontier model. The Register quotes a LinkedIn post in which Lorenc said all it took was a "basic prompt of 'find bad vulnerabilities in PHP.'" Lorenc said he decided to ship the fixes late on Tuesday and told the PHP coordinated-disclosure channel of his plans, because "people were getting hit in advance" of the official disclosure, according to The Register.

On the Foundation's account, one distributor's early binaries gave attackers a patch to study; on Lorenc's, a rumour alone was enough for an AI-assisted team to find the bugs. Either way, the two accounts describe the shrinking window between disclosure and exploitation that Amazon set out in the morning update below.

Limits of the October 22 afternoon update#

• Jiji describes the Japanese bank measures as precautionary, and none of the sources we opened reports a confirmed breach at any bank.
• Lorenc's account of rediscovering the bugs is his own, as reported by The Register; we did not open his LinkedIn post or test the claim.
• IPA's alert is in Japanese and is summarised in our translation. The Korean alert is as reported in English by The Asia Business Daily; we did not open the ministry's or KISA's own notices.
• What we checked: CISA's Known Exploited Vulnerabilities catalogue, still at the version dated October 21 when checked at 09:14 UTC on October 22, did not list either CVE.

Updated October 22, 2026: Amazon says PHP2Shell is now being broadly exploited (Amazon's claim, unverified as of October 23; see the dated note at the end of this section) and that its honeypots logged an attempt before disclosure; CISA has told organisations that cannot patch to take PHP systems offline. The new section directly below covers this; the original October 21 report follows, unchanged except that its headings now sit one level lower under a dated section.

October 22: AWS says exploitation began before disclosure and is now broad (Amazon's claim; unverified as of October 23)#

By Amazon's account, the defenders' window closed earlier than the disclosure date suggested. In a post dated Wednesday, October 21, CJ Moses, CISO of Amazon Integrated Security, wrote that Amazon Threat Intelligence found a PHP2Shell exploitation attempt in its MadPot honeypot telemetry dating to Saturday, October 17, four days before public disclosure, from an IP address associated with a commercial anonymisation network. Amazon says it remains unclear how the actor obtained exploit information while the bugs were under embargo.

Amazon says it identified multiple proof-of-concept exploits on October 21, the earliest around 02:00 UTC, and further attempts against MadPot between 02:00 and 08:00 UTC from other anonymised infrastructure, with payloads that varied enough to suggest multiple actors. After the embargo lifted at 14:00 UTC, it says, more proof-of-concept exploits appeared within hours and were used against its sensors "almost immediately." Its conclusion: "PHP2Shell is now being broadly exploited in the wild." Amazon adds that technical analysis is ongoing and that it is unclear whether any of the attempts would have succeeded against real systems.

Amazon argues that AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit, and says patch timelines for critical internet-facing flaws should be measured in hours: "A 7-day or 30-day SLA assumes a delay that no longer exists." It recommends starting PHP2Shell investigations from at least October 17 and says upgrading is "the only complete remediation" for both CVEs. Amazon published a list of IP addresses as indicators and says they include shared anonymisation infrastructure that should be investigated rather than blocked; Times of AI is not reproducing them.

CISA's October 21 alert urges organisations to patch immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and says those that cannot update immediately, or still run PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated." The alert, which gives a date but no time, says CISA "has not observed exploitation of these vulnerabilities as of the time of publication." CNBC reports that the NSA urged organisations to prepare updates and recommended taking affected systems offline if they cannot update immediately, that the FBI warned the flaws could be used to run code remotely, and that cybersecurity authorities in Singapore, the UK, Australia, Canada and the EU issued similar alerts. OpenAI said on X that it has packaged a Codex skill to help site owners check whether a website is affected.

Limits of the October 22 update#

• "Broadly exploited" is Amazon's assessment from its own honeypot sensors; Amazon says it is unclear whether the attempts would have succeeded, and none of the sources we opened gives a count of compromised systems.
• How the October 17 attempt's operator obtained exploit details is unknown, according to Amazon.
• The NSA, FBI and international alerts are as reported by CNBC; Times of AI did not review those advisories directly.
• What we checked: CISA's Known Exploited Vulnerabilities catalogue, in the version dated October 21 and checked at 02:57 UTC on October 22, did not list either CVE.
• Note added October 23, 2026: Amazon's statement that PHP2Shell "is now being broadly exploited in the wild" is reported in this section as Amazon's claim. As of October 23 it is unverified, which is not the same as shown to be wrong. Amazon and Sophos both describe real exploitation attempts, but none of the sources we opened confirms a successful compromise, and nine security firms told NBC News they had seen no successful attacks. The October 23 section above has the details.

Original report: PHP patches PHP2Shell, October 21#

By the researchers' own account, frontier AI turned flaws that had sat in PHP for more than a decade into working attacks, and a leak then shortened the time defenders had to prepare. On Wednesday, October 21, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing CVE-2026-109618 and CVE-2026-109619, two flaws collectively called PHP2Shell. heise online reports that both are rated CVSS 9.2 (critical). The planned disclosure date was moved up a day, from October 22, because of a leak, heise reports, and Cloudflare says it observed attack traffic against its customers.

What the flaws are#

Wiz, Cloudflare and BleepingComputer describe memory-safety bugs in how PHP cleans up when a request ends abnormally, for example after an out-of-memory or other fatal error. A later request handled by the same worker can then use corrupted or freed memory. Wiz says it demonstrated unauthenticated remote code execution on WordPress, Drupal and Joomla, and separately showed that attackers could read process memory containing passwords, tokens and API keys. Wiz says every PHP version back to 5.4 is affected by at least one of the bugs; Cloudflare says the flaws affect web servers running PHP 5.4 or later.

BleepingComputer says PHP's security team provided minimal source backports for PHP 7.4, 8.0 and 8.1, and quotes PHP core developer Gina Peter Banyard as warning that no mitigation fully blocks the attacks and that applying the patches is the only permanent defence. PHP has published interim configuration changes that reduce some attack paths, both BleepingComputer and heise report.

How much of the web is exposed depends on whose estimate is used. Wiz says PHP powers 70% of websites, Cloudflare says "almost 70%", and BleepingComputer puts PHP's share at 75% to 80%. Wiz calls the findings among "the most severe vulnerabilities discovered in PHP, and arguably in software history"; OpenAI calls them "one of the most impactful security issues in recent memory."

Who found it, by each account#

The accounts overlap but do not agree on order or emphasis:

• OpenAI says Calif "identified a critical flaw using GPT‑5.6 Sol" as part of its Patch the Planet initiative, "with Wiz also independently discovering and reporting both vulnerabilities."
• Wiz's timeline says it discovered the first vulnerability on August 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and reported the bugs to PHP on August 24. It says Gemini 4 Argon "made an invaluable contribution" to finding the vulnerability, building exploits, detecting attacks and validating the patch.
• heise, in an English article it says was translated from German, writes that Calif's team was first, in a code audit with the PHP Ecosystem Security Team sponsored by OpenAI's Patch the Planet, and that Wiz, which heise describes as a Google subsidiary, and OpenAI reproduced the flaws using LLMs.
• BleepingComputer says the flaws were discovered by Calif, Wiz and OpenAI researchers. Cloudflare names Calif, Wiz, OpenAI and Quarkslab as disclosing them.

The leak and the defenders' window#

Cloudflare says its web application firewall protections went live by default for free and paid customers at 03:02 UTC on October 21, about nine hours before public disclosure. It says the vulnerability leaked before the official release date, that it observed attack traffic targeting customers, and that attackers were mutating payloads to try to bypass its rules. BleepingComputer reports that Cloudflare CTO Dane Knecht confirmed early attacks before the patches were released. heise's article said there was no known evidence of exploitation by criminals at the time it was written. Cloudflare says its rules are an additional layer and that customers should still apply the PHP update.

OpenAI says it coordinated with maintainers, security providers and US agencies including the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA. BleepingComputer reports that the UK's National Cyber Security Centre told organisations to update PHP immediately or take systems offline until patched; Times of AI has not reviewed the NCSC advisory directly. OpenAI also said it has committed $1 billion in subsidised access to Daybreak, its cyber-defence offering, for organisations with limited security resources, and published a proposed framework for coordinating responses to AI-found vulnerabilities. We covered Patch the Planet when it launched in June.

Limits#

• Severity, reach and AI-contribution claims are the researchers' and companies' own; the website-share estimates come from different sources and are not reconciled.
• Discovery credit differs by account, and none of the sources sets out a single agreed sequence.
• Reports of attack activity come from Cloudflare and its CTO via BleepingComputer; the scale of exploitation is not public.

Sources#

• Cybersecurity Dive: PHP exploitation moves at slower-than-expected pace, but millions remain at risk (October 23, 2026)
• CNBC: AI's 'Black October': Critical PHP flaws set off global security scramble (October 23, 2026, 11:17 AM EDT)
• NBC News: Hackers struggle to exploit PHP flaws after cybersecurity crisis (October 22, 2026, 6:07 PM EDT)
• Sophos: Proof-of-concept exploit released for PHP vulnerabilities (correction posted October 22, 2026, 21:21 UTC)
• NCSC Netherlands (Dutch; our translation): Update: PHP-kwetsbaarheden nog steeds reden om direct te patchen (updated October 22, 2026, 16:01)
• The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security (October 21, 2026)
• The Register: PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk (October 22, 2026, 00:02 UTC)
• Jiji Press via Nippon.com: Japan Banks, Other Firms Take Precautionary Measures over PHP Flaw (October 22, 2026)
• IPA (Japanese; our translation): PHPの脆弱性対策について (CVE-2026-109618, CVE-2026-109619: PHP2shell) (October 22, 2026)
• The Asia Business Daily: Government Issues Cyber Crisis "Caution" Alert Over PHP Security Flaw (October 22, 2026)
• SANS Internet Storm Center: Stormcast for Thursday, October 22, 2026
• AWS Security Blog: Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (October 21, 2026)
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (October 21, 2026)
• CNBC: Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond (October 21, 2026, 9:05 PM EDT)
• OpenAI on X: Codex skill to check PHP2Shell exposure (October 21, 2026)
• CISA: Known Exploited Vulnerabilities Catalog JSON feed (versions 2026.10.21 and 2026.10.23, accessed October 22 to 24, 2026)
• OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities (October 21, 2026)
• Wiz Research: PHP2Shell (October 21, 2026)
• Cloudflare: Cloudflare deploys protections against php2shell vulnerability (October 21, 2026)
• heise online (translated from German): php2shell: Critical flaws allow code injection in PHP (October 21, 2026)
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws (October 21, 2026)
• Times of AI: Daybreak Full GPT-5.5-Cyber: Politically Safest Place to Ship Frontier Uplift (June 22, 2026)
• Reuters via CNA: PHP Foundation 'under-funded' with one full-time staff member, director says (October 23, 2026)
• Gizmodo: Sam Altman: 'I No Longer Think We're Gonna Be Able to Just Patch All the Bugs' (October 23, 2026)
• GitHub php/php-src security advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• GitHub php/php-src security advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)