Day 2 of the PHP2Shell incident has seen mainstream news media like the Associated Press pick up the story and security pros from the UK, Germany, and Finland to Kenya and Japan working on patching the flaws.
In the UK, the government took down 32 services and in Japan, Prime Minister Sanae Takaichi advised businesses to take down systems and patch them rather than leave them vulnerable.
According to Kevin Surace, chief executive officer at TokenCore, PHP developers first identified the underlying memory handling issue in 2024, but its ability to enable remote code execution (RCE) became clear when researchers at Calif reported a working attack on Aug. 11, 2026, which was augmented by the recent AI discovery from OpenAI.
“PHP2Shell is the first real test of what happens when AI finds bugs faster than people can patch them,” said Sagy Kratu, principal cybersecurity strategist at Vicarius. “Wiz says these flaws sat in PHP for decades until frontier models made the exploit chain practical, Amazon’s honeypots saw attempts four days before disclosure, and Cloudflare went from thousands of attacks to millions in under a day.”
Kratu said the patch itself is easy: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The hard part is that most organizations don’t know where PHP runs.
“It’s in the appliance in the rack, the portal nobody has touched since 2019, the container a contractor built, the WordPress site sales spun up for a trade show,” said Kratu. “Every one of those is an unauthenticated RCE target right now. So the order of work today is inventory, then patch the runtime, then stop trusting .ini workarounds, which watchTowr has confirmed don’t block it.”
John Strand, owner at Black Hills Information Security, said triage during the first five to seven days will be important. Teams need to identify what’s exposed, what needs immediate attention, and where an update can create compatibility problems.
“Beyond that, we need to have a serious conversation about the whole ‘if it ain’t broke, don’t fix it’ mentality,” said Strand. “Organizations keep hobbling older systems along because they still work and there isn’t an immediate exploit forcing the issue. Then something like this comes along and knocks that entire assumption over. Still working doesn’t mean still secure.”
Strand added that he ran a Shodan query and found more than 150,000 systems advertising PHP versions that appeared to fall within the affected range, including older 7.x versions and versions 8.0 and 8.1.
“That’s an indication of potential exposure, rather than confirmation that every one of those systems is exploitable,” said Strand. “But the number is still staggering.”
Scott Kuffer, co-founder and CPO of Nucleus Security, said PHP2Shell is an example of what we've been predicting could happen for a long time now: an AI model found the flaws in PHP, exploit details leaked before any patch could ship, and attacks on vulnerable systems started within hours.
Kuffer said it's so widespread that government cybersecurity agencies in the EU and Australia are already on record stressing how important remediation is, to the point where taking a website offline has become a stated mitigation step.
“As details emerge, there's one reality that will hold true,” said Kuffer. “The organizations that get through this will be those that already knew where PHP was running in their environment, who owns it, and who's responsible for updating those vulnerable systems."
Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, said the PHP Foundation's postmortem traces Oct. 20 stage-by-stage, leaked CVE identifiers with a wrong severity score, security firm Calif accidentally publishing its exploit video against live targets, and mitigation guidance for critical infrastructure providers possibly leaking too. Then Chainguard released patched container images at 07:41 UTC on Oct. 21, six hours and 19 minutes before the coordinated release, handing attackers a binary diff of the fix while every other distributor was still packaging it.
Krell said most of the proof-of-concept code flooding GitHub does not work, developer Elias Taylor tested three of the most-starred repositories against a vanilla PHP server and none achieved code execution.
“My own Shodan query this morning returned about 2.2 million internet-facing hosts advertising PHP versions older than the patched releases, roughly 54,000 of them in the UK, which pairs neatly with the NCSC's 50,000 warnings,” said Krell.
Chris Yule, senior director of threat research at the Sophos counter threat unit, said the Sophos research backs up what others are confirming, that these techniques can be used to predictably corrupt memory and bypass some implementation of ASLR protections in PHP.
With AI accelerating the weaponization process, Yule said attackers can potentially move to working exploits much faster, leaving defenders with an increasingly narrow window to respond. The research and disclosure give defenders something concrete to work from, but Yule said the harder problem is older systems and appliances running vulnerable versions of PHP that can’t simply get updated or replaced.
“Appliances in particular can be a black box within an organization’s environment, with limited visibility into patch levels and software versions and organizations often dependent on the vendor for an update,” said Yule. “In those cases, additional protections will be critical to limiting exposure. Organizations also need to identify where affected systems and appliances are still running. Otherwise, there’s a very real risk that attackers find them before defenders know they’re there.”
