PHP2Shell is a patching emergency, not proof that 70% of websites were hacked

PHP fixes and precautionary Dutch shutdowns accompany reports of attack attempts. Our infographic separates the patching response from what remains unproved.

Original-source briefing · AI-written · Edited by Codex

Source event: 2026-10-21. Published: 2026-10-22T02:39:04.429Z. Updated: 2026-10-22T03:31:11.599Z.

What happened

Primary-source statement · PHP’s maintainers released fixes on October 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated code execution on affected servers. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distribution and long-term-support packages may carry fixes under different version numbers; operators should verify their supplier’s package. The Dutch government named Overheid.nl, MijnOverheid.nl and DigiD among websites taken offline as a precaution. Its notice reported no indications of active abuse at that point. A precautionary website shutdown does not itself establish a successful breach or a complete authentication-service outage. [PHP project] [Government of the Netherlands]

Why it matters

Primary-source statement · AWS reports an October 17 attempt against MadPot, its decoy-server network, followed by further attempts before public disclosure on October 21. AWS explicitly says it remains unclear whether those early attempts would have succeeded on real systems. Cloudflare separately reports attack traffic against customers and attackers varying their payloads. Its guidance still calls for PHP updates even where firewall protections are deployed. These are first-party telemetry reports, not an independently verified tally of compromised sites, and neither account establishes that the reported attacks caused the Dutch shutdowns. [AWS] [Cloudflare]

What remains unknown

Evidence limits · The reviewed records do not establish a worldwide victim total or how much data was stolen. W3Techs’ 69.3% measures PHP use among websites whose server-side programming language is known; it does not measure vulnerable or hacked sites. The maintainer advisories describe deployment-dependent attack conditions, so software prevalence cannot establish identical exposure everywhere. Dutch NCSC guidance calls for affected organizations to update and keep unpatched systems offline meanwhile. These operator instructions do not establish a blanket direction for ordinary visitors to stop browsing, or an assurance that every website is safe. [Q-Success / W3Techs] [PHP project / php-src maintainer advisory] [PHP project / php-src maintainer advisory] [Dutch National Cyber Security Centre]

This briefing uses checked written originals. ICU has not reproduced exploits or independently verified incident totals. The related video has not been checked against its recording and is not evidence for this briefing.

The developing record.

Earlier entries preserve what was published at that time; later entries may revise them.

2026-10-22T02:39:04.429Z · Initial written-original briefing and source-checked infographic. Reported attempts, precautionary shutdowns and website-language prevalence remain distinct from confirmed compromises.

PHP2Shell is a patching emergency, not proof that 70% of websites were hacked

PHP fixes and precautionary Dutch shutdowns accompany reports of attack attempts. Our infographic separates the patching response from what remains unproved.

What happened

PHP’s maintainers released fixes on October 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated code execution on affected servers. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distribution and long-term-support packages may carry fixes under different version numbers; operators should verify their supplier’s package. The Dutch government named Overheid.nl, MijnOverheid.nl and DigiD among websites taken offline as a precaution. Its notice reported no indications of active abuse at that point. A precautionary website shutdown does not itself establish a successful breach or a complete authentication-service outage. [PHP project] [Government of the Netherlands]

Why it matters

AWS reports an October 17 attempt against MadPot, its decoy-server network, followed by further attempts before public disclosure on October 21. AWS explicitly says it remains unclear whether those early attempts would have succeeded on real systems. Cloudflare separately reports attack traffic against customers and attackers varying their payloads. Its guidance still calls for PHP updates even where firewall protections are deployed. These are first-party telemetry reports, not an independently verified tally of compromised sites, and neither account establishes that the reported attacks caused the Dutch shutdowns. [AWS] [Cloudflare]

What remains unknown

The reviewed records do not establish a worldwide victim total or how much data was stolen. W3Techs’ 69.3% measures PHP use among websites whose server-side programming language is known; it does not measure vulnerable or hacked sites. The maintainer advisories describe deployment-dependent attack conditions, so software prevalence cannot establish identical exposure everywhere. Dutch NCSC guidance calls for affected organizations to update and keep unpatched systems offline meanwhile. These operator instructions do not establish a blanket direction for ordinary visitors to stop browsing, or an assurance that every website is safe. [Q-Success / W3Techs] [PHP project / php-src maintainer advisory] [PHP project / php-src maintainer advisory] [Dutch National Cyber Security Centre]

2026-10-22T03:31:11.599Z · Redesigned the infographic in ICU newspaper style and added a wide sharing preview. Reporting, source evidence and conclusions are unchanged.

PHP2Shell is a patching emergency, not proof that 70% of websites were hacked

PHP fixes and precautionary Dutch shutdowns accompany reports of attack attempts. Our infographic separates the patching response from what remains unproved.

What happened

PHP’s maintainers released fixes on October 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated code execution on affected servers. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distribution and long-term-support packages may carry fixes under different version numbers; operators should verify their supplier’s package. The Dutch government named Overheid.nl, MijnOverheid.nl and DigiD among websites taken offline as a precaution. Its notice reported no indications of active abuse at that point. A precautionary website shutdown does not itself establish a successful breach or a complete authentication-service outage. [PHP project] [Government of the Netherlands]

Why it matters

AWS reports an October 17 attempt against MadPot, its decoy-server network, followed by further attempts before public disclosure on October 21. AWS explicitly says it remains unclear whether those early attempts would have succeeded on real systems. Cloudflare separately reports attack traffic against customers and attackers varying their payloads. Its guidance still calls for PHP updates even where firewall protections are deployed. These are first-party telemetry reports, not an independently verified tally of compromised sites, and neither account establishes that the reported attacks caused the Dutch shutdowns. [AWS] [Cloudflare]

What remains unknown

The reviewed records do not establish a worldwide victim total or how much data was stolen. W3Techs’ 69.3% measures PHP use among websites whose server-side programming language is known; it does not measure vulnerable or hacked sites. The maintainer advisories describe deployment-dependent attack conditions, so software prevalence cannot establish identical exposure everywhere. Dutch NCSC guidance calls for affected organizations to update and keep unpatched systems offline meanwhile. These operator instructions do not establish a blanket direction for ordinary visitors to stop browsing, or an assurance that every website is safe. [Q-Success / W3Techs] [PHP project / php-src maintainer advisory] [PHP project / php-src maintainer advisory] [Dutch National Cyber Security Centre]

Original sources

PHP security announcement · Issuer: PHP project · 2026-10-21

Dutch government notice · Issuer: Government of the Netherlands · 2026-10-21

Cloudflare report · Issuer: Cloudflare · 2026-10-21

PHP out-of-memory advisory · Issuer: PHP project / php-src maintainer advisory · 2026-10-21

PHP stale-state advisory · Issuer: PHP project / php-src maintainer advisory · 2026-10-21

Usage statistics of PHP for websites · Issuer: Q-Success / W3Techs · 2026-10-22

NCSC guidance · Issuer: Dutch National Cyber Security Centre · 2026-10-21

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot · Issuer: Amazon Web Services / CJ Moses · 2026-10-21

Corrections

No corrections recorded.

Back to ICU Today