PHP releases emergency patches for critical RCE flaws

Security researchers identified two critical remote‑code‑execution flaws, collectively referred to as PHP2Shell, that allow attackers to run code on any PHP server without authentication. The PHP security team released emergency patches on October 21, covering PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; older versions such as 8.1 and below no longer receive official updates.

Government sites pulled offline

Government and public services pulled offline as a precaution after the disclosure. The Netherlands’ National Cyber Security Centre shut down its own site, while the Port of Rotterdam, the Dutch government portal Overheid.nl, and the football association KNVB went dark. France’s Interior Ministry took local prefecture sites offline, and the UK’s National Cyber Security Centre warned organisations to update or shut down systems. Wikipedia’s Wikimedia Foundation also temporarily disabled services that use PHP.

Administrators are advised to apply the patched PHP versions immediately. If a host cannot update, temporary mitigations such as setting memory_limit to –1, reducing post_max_size, disabling session.upload_progress, and restarting workers can reduce exposure but do not fully block exploitation. Web application firewalls, like Cloudflare’s, can block some attack attempts, but they are not a substitute for installing the official patches.

Frontier artificial‑intelligence models accelerated the development of an exploitable payload, enabling attackers to adapt the PHP2Shell chain across different PHP versions and server configurations in hours. Cloudflare’s CTO reported early attacks exploiting the flaws, and the UK National Cyber Security Centre urged immediate patching or site shutdown. The rapid automation of exploit construction underscores the growing speed at which sophisticated vulnerabilities can be weaponised.

After patching, administrators should scan for web shells, unexpected admin accounts, and anomalous PHP files. Monitoring tools can flag unusual multipart requests, fatal error logs, or large PHPSESSID cookies that may indicate memory‑corruption exploits. Ongoing vigilance is essential until all affected servers are fully updated to a supported PHP release.