PHP2Shell: Ottawa Pulled Websites Offline. Here’s What to Patch Now

Some Government of Canada websites went offline on Wednesday, Oct. 21, hours after the PHP project shipped emergency fixes for two critical flaws, nicknamed PHP2Shell, that can let an attacker run code on a web server without logging in. The fix costs nothing: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If your business runs a PHP site, and every WordPress site is one, update it now or get your host to confirm in writing that it has, because attackers are already trying it. Amazon says it caught one attempt on Oct. 17, four days before the flaws were made public.

The clearest account of the risk is the PHP security team’s own advisory, published with the releases at 14:00 UTC. It says the people at risk are “all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.” Then the sentence that should worry anyone on older shared hosting: “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”

That means your WordPress security plugin never gets a vote.

What PHP2Shell is: two bugs in PHP itself

Both flaws sit in PHP itself, not in WordPress or a plugin, so the fix has to come from whoever manages the server.

• CVE-2026-109618, “RCE via OOM corruption.” Per the GitHub advisory linked from php.net, out-of-memory handling can interrupt PHP while internal request data is only partly set up, and cleanup may then treat that invalid data as valid.
• CVE-2026-109619, “RCE via stale global state.” Per its advisory, request data can survive after its memory is freed, and “a later request handled by the same worker may use that stale state before normal initialization resets it.”

The PHP team rated both 9.2 on the CVSS v4.0 scale. It had given advance notice on Oct. 20 of a 14:00 UTC release on Oct. 21. It shipped on schedule, but someone was already ahead of it.

In a post published late on Oct. 21, Amazon’s chief information security officer, CJ Moses, said the company’s MadPot honeypot network had recorded “a PHP2Shell exploitation attempt dating to Oct. 17, 2026,” four days before disclosure. Amazon does not know how the attacker got the details early. Public proof-of-concept code appeared around 02:00 UTC on Oct. 21, and after the 14:00 UTC release Amazon said PHP2Shell was “now being broadly exploited in the wild,” apparently by multiple actors. It also said “it’s unclear if any of these attempts would have succeeded in real-world systems.” watchTowr has reported in-the-wild exploitation too. We have not seen a confirmed breach tied to these CVEs.

How the bugs were found is its own story. The cloud security firm Wiz published its research write-up on Oct. 21. It found the first flaw on Aug. 19 and reported both to the PHP security team on Aug. 24. Wiz says it used its own Wiz Atlas tool plus Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol “throughout this research,” and that “Gemini 4 Argon made an invaluable contribution to finding the vulnerability.” Its demonstrations used the stock wordpress:latest, drupal:latest and joomla:latest container images: all three fell to CVE-2026-109618, and WordPress and Drupal to CVE-2026-109619. OpenAI has also claimed credit for its model, BetaKit reported; Wiz names both labs, and singles out Gemini.

What Ottawa took offline, and what it hasn’t said

The Canadian Centre for Cyber Security posted alert AL26-026, “Critical vulnerabilities impacting PHP – CVE-2026-109618 and CVE-2026-109619,” dated Oct. 21. That afternoon, Evan Solomon, the Minister of Artificial Intelligence and Digital Innovation, said on X that some federal sites had been taken down “as a precaution to protect government systems and Canadians’ information,” following Cyber Centre guidance, as quoted by BetaKit. He added: “This is a global issue, and other governments and organizations are also taking protective measures.”

He named no sites, and neither did The Canadian Press report carried by CTV News. As of the morning of Oct. 22, no department has said publicly that its own site is down, and we are not going to guess which ones are. The government has also not said whether any federal system was actually attacked.

Outside Ottawa, the University of Victoria said on its news site on Oct. 21 that University Systems had “temporarily taken these services offline” because of “a global cybersecurity issue,” adding that it was “waiting for a security update from system vendors.” The notice does not name PHP. Other Canadian sites were reported offline, but we name only those confirmed by the organisations themselves.

Abroad, BetaKit reported that Denmark, Finland and France temporarily pulled some government sites, as Bloomberg also reported for Europe.

Ottawa has run this play before: Log4Shell, December 2021

Ottawa has done this before. The Canada Revenue Agency’s own Question Period note on the Log4j flaw, received Dec. 13, 2021, says: “On December 10, 2021, the CRA became aware of a security vulnerability affecting organizations around the world.” It disabled “My Account, My Business Account and Represent a Client” within hours, and reported that “most of our digital services have been restored as of December 13, 2021.” It found “no indication that CRA systems have been compromised.”

On Dec. 12, 2021, then-Defence Minister Anita Anand issued a statement saying “some departments have taken their services offline” while the flaw was assessed. Quebec went further and shut down thousands of government sites for review.

One difference stands out. In 2021, the CRA wrote down its own outage, in a note that later became public. In 2026, so far, the federal record is one minister’s post and a Cyber Centre alert title. Our read: shutting down first is sensible for government servers. It is a much harder call for a small business whose only storefront is a WordPress site.

How to check your PHP version and handler

Work in this order.

1. Find your PHP version and Server API. In WordPress, go to Tools > Site Health > Info, open the Server section, and read “PHP version” and “PHP SAPI.” If SAPI says apache2handler, you are on mod_php, the setup the PHP team calls highest risk. fpm-fcgi means PHP-FPM, and cgi-fcgi means CGI or FastCGI. Both are still affected. Outside WordPress, a temporary phpinfo() page shows the same “Server API” line; delete it when you are done.
2. Compare against the table below. Anything lower than the fixed number on your branch is vulnerable.
3. On shared or managed hosting, ask your host three questions. Which PHP build is my site on now? Has it been updated to a fixed release or a vendor-patched package? Are other PHP versions in my control panel also patched? The PHP team says Linux distributions and long-term-support vendors “received the patches in advance,” so a patched package may carry a distribution version number rather than 8.x.27-style numbering. Ask for the package name.
4. On PHP 8.1 or older, plan a move. The PHP project no longer releases those branches. Its source backports for 7.4, 8.0 and 8.1 only help people who compile PHP themselves.
5. If you truly cannot update today, the PHP advisory lists stopgaps, such as setting session.upload_progress.enabled=0 in php.ini and lowering post_max_size. The PHP team is blunt that these “reduce exposure to specific attack paths but do not make an installation safe.” Amazon adds one more: consider blocking multipart uploads, after checking what that breaks.
6. After patching, look for anything already inside. As we found with the Citrix NetScaler web shells, a patch closes the door but does not evict whoever came through it. Look for recently modified .php files, especially in upload folders, and, as Amazon suggests, search your logs for form-upload POST requests containing the string PHP_SESSION_UPLOAD_PROGRESS.

What it means for you

For a hosted WordPress site, the job is one support ticket and a Site Health check afterward. On your own server, it is a package update and a restart of every PHP worker. Our October Patch Tuesday guide has the rest of this month’s queue, and the privacy and security desk will update as departments confirm which federal sites went down. While you are in your host’s panel, turn on passkeys or two-factor sign-in.

“There are no complete mitigations, updating is the only safe choice.” (PHP release notes for 8.5.12, 8.4.27, 8.3.36 and 8.2.35, Oct. 21, 2026)

One more date belongs on your calendar. The PHP 8.2.35 release note says that branch “reaches end of life on 31 December 2026 and will receive no further security fixes after that date.” That is 71 days after this patch. A site that only just got to 8.2.35 will be back on the unsupported list by New Year’s Day.