Current outcome
Cloudflare reported millions of exploit attempts against two critical PHP vulnerabilities, including thousands before public disclosure, after the PHP Foundation released emergency patches and acknowledged resource shortages delayed a fix.
Progress timeline
16 material updates- #01
【慢雾：PHP 存在两个严重安全漏洞，建议相关团队排查使用 PHP 的服务器及业务系统】
SlowMist warned that PHP contains two critical CVSS 9.2 vulnerabilities potentially allowing remote code execution, urging teams to audit PHP-based servers and business systems and to apply the official patch scheduled for release at 22:00 Beijing time on October 21.
Source evidence: foresightnews · theblockbeats · theblockbeats · theblockbeats · theblockbeats · wublockchainenglish · theblockbeats · theblockbeats · Decrypt
- #02
PHP2Shell: AI uncovers critical RCE in PHP
Wiz publicly disclosed technical details of PHP2Shell: multiple PHP core flaws (including RCE, use-after-free, and OPcache type confusion) mapped to two CVEs, with proof-of-concept exploits against WordPress, Drupal, and Joomla, and AI-assisted discovery in the disclosure process.
State after update: Technical details and proof-of-concept exploits for PHP2Shell are now public, increasing exploitation risk; the official patch remains scheduled for release and urgent mitigation is required.
Source evidence: danlark1
- #03
Updated PHP version released to GitHub
PHP 8.2.35 was published to GitHub as the fix release for a critical RCE ('php2shell') disclosed in coordination with Wiz, Calif and OpenAI, with community members noting the release commit appears detached from any branch.
Source evidence: tuyuri
- #04
PHP曝出严重安全漏洞，欧洲多国政府网站大规模下线
A new PHP version with fixes has been officially released; meanwhile, reports of active exploitation led multiple European government, hospital, and port websites in countries including the Netherlands and Finland to be precautionarily taken offline and emergency patched.
State after update: The PHP patch has now been officially released, but reports of active exploitation and precautionary takedowns of multiple European critical websites indicate expanding risk and impact; urgent updating and mitigation are required.
Source evidence: theblockbeats
- #05
OpenAI复盘PHP漏洞风波：秘密协调两个月，却被论坛提前泄密
OpenAI's retrospective disclosed that the PHP vulnerabilities were found with AI model assistance and that OpenAI led roughly two months of secret coordination; disclosure was planned for Oct 22 but a Hacker News forum leak on Oct 20 exposed the CVE details, severity and disclosure timing, forcing PHP to issue an early alert and move the patch release up by one day; the fix touched nearly 200 files and more than 10,000 lines of code.
State after update: PHP released fixes on Oct 21; OpenAI's retrospective confirms the AI-assisted discovery and two-month coordination, and discloses that an early forum leak forced PHP to issue an early alert and move the patch release up by one day, while Cloudflare observed early attack attempts and some government sites proactively went offline.
Source evidence: theblockbeats
- #06
⚡️美国白宫：10月16日已获悉PHP漏洞，正协调加快修复补丁发布
The White House said it learned of the PHP vulnerability on October 16 and is coordinating with federal agencies and system integration labs to accelerate patch release and assess potential impacts on government systems and critical infrastructure.
State after update: The PHP patch has been released amid active exploitation and precautionary takedowns of European critical websites; the White House has now intervened to coordinate federal agencies on accelerating fixes and assessing risks to government systems and critical infrastructure.
Source evidence: theblockbeats
- #07
Today's PHP Security Release, and How We're Strengthening PHP Security
The PHP Foundation disclosed that Chainguard unilaterally broke the coordinated-release embargo more than six hours early by publishing built images containing the fix, which contributed to Calif mistakenly publishing a video; this adds new facts about the disclosure-process breach around the same PHP security release.
State after update: The coordinated PHP security release on 2026-10-21 has occurred, but the embargo was broken early by Chainguard, prompting criticism and a mistaken early video from Calif; the disclosure process is now in post-release controversy and remediation discussion.
Source evidence: ejohnso49
- #08
Remotely exploitable PHP bug found on 70% of world’s websites
Two critical PHP flaws collectively dubbed PHP2Shell allow unauthenticated attackers to execute code on web servers, and while emergency patches shipped for PHP 8.2+, over a third of PHP-based sites remain unpatched and some 800,000 hosts run branches that will never receive a fix.
Source evidence: Protos
- #09
Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course
OpenAI says its models discovered the severe PHP2Shell flaws in PHP that prompted several European governments to pull websites offline, and it led a two-month coalition with Calif and Wiz to get the bugs fixed.
Source evidence: Decrypt
- #10
PHP Foundation admits ‘structural failure’ delayed critical security fix
The PHP Foundation released emergency patches for two critical vulnerabilities that could let unauthenticated attackers execute code on vulnerable servers, after acknowledging that structural failures delayed a fix first identified in 2024 and as government websites went offline as a precaution.
Source evidence: Cointelegraph
- #11
PHP Foundation承认结构性失误，关键安全漏洞修复延误
The PHP Foundation publicly admitted a "structural failure," saying decision hesitation and insufficient resources caused repair work on the critical flaws first reported in 2024 to stall and restart repeatedly; government websites or online services in Germany and Australia were also temporarily taken offline to prepare patches.
State after update: Emergency patches for the PHP2Shell critical flaws have been released, but the PHP Foundation has admitted structural failures and delays in the remediation process; some government websites or online services in the Netherlands, Finland, France, Germany and Australia were temporarily taken offline to apply fixes.
Source evidence: theblockbeats
- #12
PHP漏洞波及日本多方，日本政府已暂时停止公开部分网站内容
Japan's Chief Cabinet Secretary Minoru Kihara said the severe PHP vulnerability has affected financial institutions, companies, local governments, and government agencies in Japan, with no damage reported so far; the health and finance ministries temporarily stopped publishing some website content as a precaution and urged organizations to install patches.
State after update: After the PHP Foundation released emergency patches for two critical vulnerabilities, Japan became the latest affected country: some Japanese government ministry websites temporarily stopped publishing content as a precaution, and financial institutions, companies, and local governments were affected with no damage reported so far.
Source evidence: theblockbeats
- #13
WordPress回应PHP严重漏洞：建议网站运营方立即更新升级
WordPress warned site operators to immediately update PHP and confirm hosting-provider patches and WAF mitigations because of a severe PHP vulnerability affecting servers running PHP applications.
Source evidence: theblockbeats
- #14
PHP严重漏洞曝光后攻击激增，Cloudflare监测到数百万次尝试
Cloudflare CEO Matthew Prince said the company monitored millions of exploitation attempts after the severe PHP vulnerability was publicly disclosed: thousands in the 10 hours before disclosure, tens of thousands within 45 minutes after, hundreds of thousands within two hours, and millions now.
State after update: The PHP Foundation has released emergency patches for two critical vulnerabilities, some government websites in Japan and Europe have paused or taken content offline as a precaution, and Cloudflare reports exploitation attempts surged to millions after disclosure.
Source evidence: theblockbeats
- #15
中国工信部NVDB发布关于防范PHP远程代码执行超危漏洞的风险提示
China's MIIT National Vulnerability Database (NVDB) issued a risk advisory for the same two critical PHP remote code execution vulnerabilities, listing affected version ranges: 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35, and 8.1 and earlier.
State after update: The PHP Foundation has released emergency patches; some government websites in Japan, Europe, and Australia paused or took content offline as a precaution; Cloudflare reports millions of exploitation attempts after disclosure; China's MIIT NVDB has now issued a risk advisory specifying affected version ranges.
Source evidence: theblockbeats · foresightnews
- #16
PHP flaw draws millions of exploit attempts, Cloudflare CEO warns
Cloudflare reported millions of exploit attempts against two critical PHP vulnerabilities, including thousands before public disclosure, after the PHP Foundation released emergency patches and acknowledged resource shortages delayed a fix.
Source evidence: Cointelegraph