PHP2Shell timeline
PHP2Shell timeline: from disclosure to patches and alerts
A dated record of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), from the researchers' report to the PHP project in August to CISA's Known Exploited Vulnerabilities listing on 26 October 2026. Every entry links to the organisation that published it.
Last reviewed against php.net, the NCSC, CISA and the source linked on each entry.
At a glance
The key dates
The fix and the first government alerts landed on the same day, 21 October 2026. CISA's listing of both flaws as known to be exploited followed five days later.
| Date | What happened | Published by |
|---|---|---|
| 24 Aug 2026 | Researchers report the flaws to the PHP project | Wiz Research |
| 20 Oct 2026 | Advance notice of a critical release | php.net |
| 21 Oct 2026 | Fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35; NCSC and CISA alerts | php.net, the NCSC, CISA |
| 21 Oct 2026 | Dutch government websites taken offline as a precaution | Rijksoverheid.nl |
| 23 Oct 2026 | Related advisory CVE-2026-115560; CISA detection rule | php.net, CISA |
| 26 Oct 2026 | Both CVEs added to the Known Exploited Vulnerabilities catalogue | CISA |
How this record is kept
Each entry carries the date its source gives and links to that source. Entries come only from primary publishers: the PHP project, national cyber security agencies, the researchers, Linux distributions, and organisations speaking for themselves. A press report on its own does not earn an entry. Times appear only where the source states one, and the review date under the heading shows when every link was last checked.
The full timeline
PHP2Shell, day by day
Oldest first. For what each flaw does and which versions fix it, see the PHP2Shell reference page.
-
Researchers
The flaws are reported to the PHP project
Wiz Research says it passed its findings to the PHP security team on this date, a few days after confirming code execution without a login against Drupal (20 August) and WordPress (21 August).
-
Researchers
The PHP project starts work on a coordinated fix
The researchers' published timeline records the PHP project acknowledging the reports on this date and starting work on a fix to be released in step with public disclosure.
-
PHP project
Advance notice of a critical security release
php.net announces a release for Wednesday 21 October at 14:00 UTC (15:00 UK time) to fix two critical vulnerabilities, each scored 9.2 under CVSS v4.0 by the PHP project. The notice warns that the release could come sooner if details leaked or attacks began.
-
Netherlands
NCSC-NL tells organisations to get ready to patch
The Dutch national cyber security centre advises treating any internet-facing system with PHP as probably vulnerable until it is patched, assessing each one, and considering extra steps such as taking it offline.
-
Netherlands , 15:13 Dutch time
Dutch government websites go offline as a precaution
The Dutch government reports that several websites, Overheid.nl, MijnOverheid.nl and DigiD among them, have been taken offline as a precaution. Its statement records no sign of active exploitation at that point and notes that Rijksoverheid.nl does not run on PHP. It was published before the fixed releases were due.
-
PHP project
Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
The PHP project publishes its security advisory with four fixed releases. CVE-2026-109618 is remote code execution through out-of-memory handling; CVE-2026-109619 is remote code execution through stale state left between requests. The advisory treats its interim settings as partial and says only updating is safe. For PHP 7.4, 8.0 and 8.1, which are out of support, it points to source-level backports rather than new releases. The PHP 8.6.0 RC4 pre-release carries the same fixes.
-
Researchers
The researchers publish their findings as PHP2Shell
Wiz Research publishes its write-up under the name PHP2Shell, with a disclosure site that credits co-researchers at two other organisations. It reports using a single combined exploit script to show code execution without a login against WordPress, Drupal and Joomla.
-
UK
NCSC alert: Critical security issue affecting PHP
The NCSC tells UK organisations that any version of PHP is affected and lists six priority actions in order: find every PHP system, update, apply the temporary mitigations if updating is not possible, consider taking the system offline if neither can be done quickly, check for compromise and backdoors, and watch for updates to products that bundle PHP.
-
United States
CISA alert: patch immediately
CISA asks organisations to inventory every PHP system and patch at once, internet-facing systems first. Systems that cannot be updated straight away, or that run PHP 8.1 or earlier, should be taken offline. It adds that a web application firewall may help in the meantime and that defenders should watch for PHP worker processes starting shells or fetching tools.
-
France and Canada
CERT-FR and the Canadian Cyber Centre issue alerts
France's CERT-FR publishes alert CERTFR-2026-ALE-014, advising that affected systems be isolated and then moved to a maintained, patched version. The Canadian Centre for Cyber Security publishes alert AL26-026 the same day.
-
Linux distributions
Ubuntu and Debian ship fixed packages
Ubuntu publishes notice USN-8948-1 covering its supported releases, and Debian publishes DSA-6574-1 for the php8.4 package in Debian 13. Distribution packages keep their own version numbers: the fixed package for Ubuntu 24.04 is 8.3.6-0ubuntu0.24.04.13, which looks older than the PHP project's 8.3.36 but carries the fix.
-
France
CERT-FR: proofs of concept exist
CERT-FR updates its alert to say it knows of proofs of concept for both CVEs that work against specific PHP deployments.
-
Netherlands
NCSC-NL looks into possible exploitation
NCSC-NL says it is investigating early signs of successful exploitation.
-
Netherlands
Logius websites back online
Logius, which had taken several of its websites offline as a precaution on 21 October, reports that they are reachable again.
-
PHP project
Informational advisory: CVE-2026-115560, session upload progress
A related issue that only arises when an application changes session.serialize_handler at runtime in a particular way. php.net suggests switching session upload progress off until its next regular bugfix release, which will carry the full advisory.
-
United States
CISA adds a SIGMA detection rule
CISA updates its alert with a SIGMA rule for spotting suspicious activity, links to partner resources and firmer wording on mitigation.
-
Netherlands
NCSC-NL: one possible case abroad, still patch now
NCSC-NL reports a single possible exploitation outside the Netherlands, not confirmed as successful, and says analysis shows exploitation is complex, so large-scale attacks look less likely than first feared. It still tells organisations to patch without waiting for signs of attack.
-
United States
FBI public service announcement
The FBI's Internet Crime Complaint Center issues notice I-102326-PSA. It recommends taking systems offline until they can be fully mitigated if they cannot be updated, monitoring for PHP processes that open command shells or download files, and, where compromise is suspected, isolating the system and keeping its web server and PHP logs.
-
United States
Both CVEs added to CISA's Known Exploited Vulnerabilities catalogue
CISA lists CVE-2026-109618 and CVE-2026-109619 in its Known Exploited Vulnerabilities catalogue. The entries carry a due date of 29 October 2026 and call for forensic triage as well as mitigation.
-
PHP project
Updated Windows builds for a Brotli fix
New Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) bundle Brotli 1.2.1 to fix CVE-2026-111497, an out-of-bounds write. The PHP runtime versions do not change. The flaw is reachable through the cURL extension only when HTTP response decompression is switched on, which cURL leaves off by default.
-
France
CERT-FR reports exploitation attempts
CERT-FR adds CVE-2026-115560 to its alert and says it has seen attempts to exploit CVE-2026-109618 and CVE-2026-109619 against specific PHP deployments.
Precautionary takedowns
Organisations that took services offline
Taking a site offline until it is fixed was part of the official advice. The NCSC's fourth priority action says to consider it when neither the update nor the interim settings can be applied quickly. CISA, NCSC-NL and the FBI gave similar advice.
In the Netherlands, government websites went offline before the fixes were even out. An organisation is listed here only once it, or its government, has published its own statement. Other takedowns have been reported in the press and will be added if they are confirmed that way.
Facing the same decision? Use the risk calculatorNetherlands
- 21 October 2026: the Dutch government said several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were offline as a precaution, after NCSC-NL advised site owners to weigh the risk for themselves. Statement (Dutch)
- 22 October 2026: Logius said the websites it had taken offline the day before were reachable again. Statement (Dutch)
Comparison
PHP2Shell and Log4Shell compared
Log4Shell, made public in December 2021, is the obvious yardstick: at the time the NCSC warned it could be the worst computer vulnerability for years. The two share a lot. They differ most in where the flaw lives, and that changes who has to act.
| Aspect | PHP2Shell | Log4Shell |
|---|---|---|
| Identifiers | CVE-2026-109618 and CVE-2026-109619 | CVE-2021-44228, followed by further Log4j flaws such as CVE-2021-45046 |
| Where the flaw sits | PHP itself: the runtime that executes PHP websites, and the copies of PHP built into other products | Apache Log4j, an open-source logging library built into Java applications and services |
| What an attacker gains | Code execution on the web server without logging in (php.net) | Control of an affected system without logging in (CISA) |
| What is affected | Every PHP installation serving web requests, per php.net; any version, per the NCSC | Log4j 2.0-beta9 to 2.14.1, per CISA |
| How it was fixed | One set of releases on 21 October 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 | Several rounds of releases; CISA's guidance settled on 2.17.1 for Java 8, 2.12.4 for Java 7 and 2.3.2 for Java 6 |
| Who applies the fix | Whoever runs PHP: you, your host, your Linux distribution or the maker of a product with PHP inside | The maker of each application that bundled the library, or your own developers for in-house code |
| US government response | Added to CISA's Known Exploited Vulnerabilities catalogue on 26 October 2026 | CISA Emergency Directive 22-02 on 17 December 2021; added to the same catalogue |
Log4Shell sources: CISA's Apache Log4j guidance and the NCSC's Log4j explainer (published 14 December 2021). PHP2Shell sources: the PHP project's advisory, the NCSC alert and the KEV catalogue.
Why patching PHP is different from patching a library
Log4j lived inside each Java application that used it, so the fix meant tracking down every application carrying a copy and waiting for each maker to rebuild. PHP sits underneath the application. Updating one PHP installation fixes every site that installation serves. That part is simpler. Three things make it harder than it sounds.
- The update is often someone else's job. Shared and managed hosting, Linux distribution packages and appliances with PHP built in are all patched by their supplier. The NCSC's sixth action is to watch those vendors, and NCSC-NL keeps an inventory of affected products.
- The version number can mislead. Distributions backport the fix into the version they ship. On Ubuntu 24.04 the fixed package is version 8.3.6-0ubuntu0.24.04.13, numerically well below the PHP project's 8.3.36, so a version check alone can raise a false alarm or give false comfort. Reading backported versions.
- Old branches split the answer. The PHP project ships no release for 8.1 or older, and CISA says to take those systems offline. Yet some distributions patched their own older packages: Ubuntu 22.04's PHP 8.1 package received the fix on 21 October 2026. Whether an old server is covered depends on where its PHP came from.
One thing is the same for both. A patch stops new attacks but removes nothing already planted, which is why CISA's catalogue entries for PHP2Shell call for forensic triage as well as the update. Signs of compromise and what to do.
Keep watching
The primary sources to follow
New entries on this page will come from these publishers first.
- php.net news
Releases and advisories from the PHP project, including the full CVE-2026-115560 advisory when it ships.
- The NCSC alert
The UK's priority actions. The page was last modified on 23 October 2026.
- The CISA alert
US guidance, with dated notes on each update.
- CISA's Known Exploited Vulnerabilities catalogue
Search either CVE ID for the listing and due date.
- NCSC-NL's php2shell repository
An inventory of products with a PHP dependency and their status, still being updated on 27 October 2026.
- Ubuntu and Debian CVE trackers
Fixed package versions per release. Debian's tracker is at security-tracker.debian.org.
Quick answers
PHP2Shell timeline questions
When was PHP2Shell disclosed?
The researchers reported the flaws to the PHP project on 24 August 2026, according to Wiz Research's published timeline. The public learned of them in two steps: php.net gave advance notice of a critical release on 20 October 2026, and the fixes and full details followed on 21 October 2026.
When was PHP2Shell fixed?
On 21 October 2026, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ubuntu and Debian published fixed packages the same day. PHP 8.1 and older get no release from the PHP project, though it published source backport branches for 7.4, 8.0 and 8.1.
Has PHP2Shell been exploited?
CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 26 October 2026, and France's CERT-FR reported exploitation attempts against specific PHP deployments the same day. NCSC-NL said on 23 October that exploitation is complex. Proofs of concept are known. Any server that ran a vulnerable build on the internet should be checked.
Which organisations took websites offline because of PHP2Shell?
The Dutch government said on 21 October 2026 that several websites, including Overheid.nl, MijnOverheid.nl and DigiD, had been taken offline as a precaution, and Logius said on 22 October that its websites were back. Other takedowns have been reported in the press; this timeline adds an organisation only once it, or its government, has said so itself.
Is PHP2Shell the new Log4Shell?
They are alike in kind: both let an attacker with no login run code, and both went onto CISA's Known Exploited Vulnerabilities catalogue. The big difference is where the fix lives. Log4j was a library built into applications and services all over the internet, so each one needed its own update. PHP is the runtime underneath the site, so the update is made once per PHP installation, often by a host or a Linux distribution rather than by the site owner.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.