PHP2Shell’s Fix Is Out — ‘Patch Deployed’ Still Isn’t ‘Patch Installed’

PHP released fixes on Wednesday for the two server-side flaws nicknamed PHP2Shell, but the protection reaches users only after every hosting company, IT department and solo website owner applies the update and restarts the software. The bugs let a stranger take control of a vulnerable server without logging in, while PHP powers about 70% of websites whose server-side language is known. By Thursday, a day after the Wednesday disclosure, attackers were still hammering exposed systems as governments took websites offline as a precaution.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP’s release notes stated: “There are no complete mitigations, updating is the only safe choice.” As of Thursday, PHP had not issued a follow-up patch, and PHP does not update itself. PHP 8.1 and earlier no longer receive official releases, although PHP’s security team posted bare-bones patches for 7.4, 8.0 and 8.1 for people who compile the software themselves.

Cloudflare CEO Matthew Prince wrote on October 22, 2026, in a post tagged #php2shell: “In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

Amazon went further, saying its decoy servers logged an attempt on October 17, four days before the bugs went public. Amazon CISO CJ Moses wrote: “It remains unclear how the actor acquired exploit information prior to disclosure,” adding that PHP2Shell is “now being broadly exploited in the wild.”

No successful government break-in linked to the flaws has been confirmed. Thomas Caspers, vice president of Germany’s federal cybersecurity agency BSI, said the agency had seen attacks but no successful use of the flaws, adding: “It seems a little bit more complicated than expected to exploit.” Japan’s Chief Cabinet Secretary, Minoru Kihara, also said no attacks exploiting the flaws had been confirmed. For most people, the risk sits with the websites they visit, not their own phones or laptops, and remains until the relevant site installs the update.