PHP2Shell Attack: PHP Flaws and ConnectWise Hack Explained

WASHINGTON, Oct. 22, 2026 — Government agencies and companies on three continents took websites offline on Wednesday, Oct. 21, after the developers of PHP, the programming language behind most of the web, disclosed two critical flaws that let an attacker take over a web server without logging in. The same day, Microsoft said a China-state aligned group was behind a separate supply-chain attack on the IT company ConnectWise. U.S. cyber and intelligence agencies issued emergency guidance on both fronts.

What happened: the timeline

According to Reuters, PHP’s developers said on Tuesday, Oct. 20, that they had found two critical vulnerabilities and would release a fix soon. The BBC reported that details of the flaws had leaked on social media that day, which forced the PHP Foundation to announce the problem earlier than planned.

The PHP project’s security advisory, dated Oct. 21, released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Reuters reported that the fix went live at about 1345 GMT (9:45 a.m. ET). Before and after the release, several governments chose to go dark rather than risk a break-in:

Finland temporarily shut down the government’s public web services, the BBC reported.
The Netherlands’ cybersecurity agency took its own website offline as a precaution, according to Reuters and the BBC; the website of the Tweede Kamer, the lower house of parliament, also became unreachable.
The Wikimedia Foundation said it had “taken down a number of other systems as a precautionary measure,” which made parts of Wikipedia unavailable, the BBC reported.
Edinburgh’s council and several BBC programme sites went offline, though the BBC said neither had confirmed a link to PHP.

Who is exposed and how the flaws work

The PHP advisory says the risk covers “all PHP installations serving web requests,” including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php as the highest risk, citing “a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.” Web tracker W3Techs counts PHP on roughly 75% of websites whose language can be identified, Reuters reported, and that includes every WordPress site.

The two flaws, which researchers nicknamed “PHP2Shell,” are:

CVE-2026-109618: out-of-memory handling can interrupt PHP while request data is only partly set up, and the cleanup step then treats that bad data as valid.
CVE-2026-109619: internal state from one request can survive after its memory is freed, and a later request on the same worker can use it.

The researchers who found the bugs were from the security firms Calif and Wiz, working with advanced AI tools under OpenAI’s “Patch the Planet” program, according to the BBC. Wiz called them the “most severe vulnerabilities ever discovered” by AI and estimated that “roughly 70%” of the internet is affected, a figure the BBC said it could not verify.

Signs of exploitation

The evidence of attacks so far is limited and comes from private companies. Dane Knecht, Cloudflare’s chief technology officer, wrote on X: “We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only.” By contrast, CISA’s alert said the agency “has not observed exploitation of these vulnerabilities as of the time of publication.” As of Oct. 22, neither CVE appeared in CISA’s Known Exploited Vulnerabilities catalog.

The second front: ConnectWise and Storm-0940

The PHP scramble overshadowed an attack with a named state-linked culprit. In a Microsoft Security blog post on Oct. 21, Microsoft said it “assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise,” and described Storm-0940 as “a China-state aligned actor” active since 2021.

Microsoft said the group used ARTEX, an open-source AI penetration-testing framework, to automate its campaign. After taking control of ConnectWise Cloud Backup applications, the group tried to sign in to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts per minute, the company said. Across the wider campaign, Microsoft said, the group sometimes went from first targeting to privileged access in less than three hours. Microsoft added that a successful sign-in “does not necessarily indicate that customer data was accessed or exfiltrated.” ConnectWise CEO Manny Rivelo said in a statement reported by Reuters that the company had “contained the affected application connections.” A spokesperson for the Chinese Embassy in Washington told Reuters that China opposes “smears and attacks against China under the excuse of cybersecurity issues.”

On the same day, CISA, the FBI and the Secret Service published a joint advisory on SafePay ransomware, a group the FBI said has targeted more than 600 victims worldwide.

Official responses

In a press release, the National Security Agency said PHP2Shell “could allow attackers to take control of affected web servers without prior access or authentication” and warned that “cyber actors are likely to weaponize” the flaws. The NSA said the risk is serious enough “to require immediate patching across United States Government departments and agencies.” The BBC reported that the White House said federal agencies were working with leading AI labs to speed up a fix. Britain’s National Cyber Security Centre, CERT-EU, Japan’s national cybersecurity office and Australian authorities issued similar warnings, and Japanese Prime Minister Sanae Takaichi urged site owners on X to check whether their websites run PHP.

What organizations and site owners should do

CISA and the NSA list these steps:

Inventory every system that runs PHP, including products that bundle it without saying so.
Update to a fixed release at once, starting with internet-facing servers.
Take PHP systems offline if they cannot be updated, or if they run PHP 8.1 or older.
Use a web application firewall as a temporary shield only.
Watch for PHP worker processes that launch shells or download tools, and add logging.

For WordPress owners, the plugin maker Wordfence warned that automatic WordPress updates will not apply this fix, so site owners on shared hosting need to confirm that their host has updated PHP. ConnectWise customers should follow Microsoft’s advice to review service-principal sign-ins and unexpected application credential changes.

Analysis: what it means

Analysis: Wednesday showed two sides of AI in cyber conflict. Defenders used AI models to find decade-old flaws in core internet software, while, by Microsoft’s account, a state-aligned group used AI agents to attack at machine speed. The leak before the planned release turned a coordinated fix into a race, and the decision by several governments to shut their own sites shows how few options exist when the vulnerable layer sits beneath almost everything. The key indicators to watch are whether CISA adds the CVEs to its exploited list, and how quickly hosting providers patch the long tail of small sites.

FAQ

What is PHP2Shell?

It is the nickname for CVE-2026-109618 and CVE-2026-109619, two flaws in PHP that allow remote code execution without a login, according to CISA.

Was any government hacked through PHP2Shell?

No official source has reported a confirmed breach. The government sites that went dark were taken offline as a precaution, according to Reuters and the BBC.

Who was behind the ConnectWise attack?

Microsoft attributed it to Storm-0940, a group it calls China-state aligned. China’s embassy rejected what it called smears.

Is my WordPress site at risk?

Any site running an unpatched PHP version is exposed, according to the PHP project. Ask your host which PHP version your site runs.