PHP Releases Emergency Patches for PHP2Shell Vulnerabilities as Exploit Attempts Surge
PHP issued patches for two critical flaws while Cloudflare reports millions of exploit attempts and governments see no confirmed breaches.
Why it matters
The vulnerabilities affect the software running on a majority of known server-side websites, and active exploitation is underway. Protection depends on server operators applying updates promptly, leaving a window of exposure for unpatched sites.
Key facts
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21 to fix PHP2Shell vulnerabilities
Reported by Decrypt
Cloudflare's CEO said exploit attempts climbed into the millions
Reported by Decrypt
Germany's BSI and Japan's government said they had not confirmed any successful break-ins
Reported by Decrypt
The PHP Foundation said it spotted signs of one flaw in 2024 and called the delay in fixing it a structural failure
Reported by Decrypt
A fix only helps once someone installs it and restarts PHP
Reported by Decrypt
What happened
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21 to address the PHP2Shell vulnerabilities that allow unauthenticated server takeover. Cloudflare's CEO reported exploit attempts reaching into the millions. Germany's BSI and Japan's government stated they had not confirmed any successful intrusions. The PHP Foundation acknowledged detecting signs of one flaw in 2024 and called the delayed fix a structural failure. The patches only protect servers once administrators install them and restart PHP.
How the story developed
- Official statement
PHP releases emergency patches for PHP2Shell
Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 published
- First report
First report by Decrypt
Is the Internet Safe Again After the PHP Nightmare? What You Need to Know
- Update
Cloudflare reports millions of exploit attempts
CEO states attack volume surged after disclosure
- Official statement
PHP Foundation acknowledges 2024 detection of flaw
Calls delayed fix a structural failure
- Update
BSI and Japan government report no confirmed breaches
Authorities say no successful intrusions verified
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 22 Oct 2026, 22:21 UTC: Decrypt — 1 independent source, 1 reports
Affected entities
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Decrypt Crypto media | Is the Internet Safe Again After the PHP Nightmare? What You Need to Know | Original | |
| Crypto News (CryptoNews.net) Aggregator | Is the Internet Safe Again After the PHP Nightmare? What You Need to Know | Syndicated |
Related events
North Korean-linked WaterPlum compromised crypto wallets through fake IT job interviews
Authorities linked WaterPlum to North Korea and said fake coding tests infected at least 30,000 devices, affected roughly 7,000 crypto wallets and took about $10.7 million.
Deutsche Bank Prepares German Crypto Custody Launch With 2027 Asian Expansion Target
Deutsche Bank plans to launch institutional crypto custody in Germany within weeks, starting with Bitcoin, Ethereum and select stablecoins, before expanding to Asian financial centers in 2027.
Payward signs definitive agreement to acquire Saldo Finance Oy, gaining EU banking licence through Lithuanian Saldo Bank
Kraken parent Payward agreed to buy Finnish holding company Saldo Finance Oy, owner of Lithuania-licensed Saldo Bank, for an undisclosed sum with closing expected in 2027 pending regulatory approval.
Ledger halts German retail sales and Southeast Asia distribution after hardware wallet tampering discovered
Ledger suspended sales in Germany and Southeast Asia after discovering hidden implants in hardware wallets that steal recovery phrases; Trezor tightened its reseller network as a precaution.
ESMA and regulators in France, Germany and Greece question Binance over MiCA reverse solicitation
ESMA and national regulators in France, Germany and Greece are examining whether Binance properly relied on MiCA's reverse solicitation exemption to keep serving EU customers after July 1 without a licence.
Ledger halts reseller sales across seven Asian markets while investigating tampered hardware wallets
Ledger ordered resellers in Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia and Hong Kong to stop sales and pull devices after discovering hardware implants that steal recovery phrases.
