PHP Patch Push Brings Precautionary Shutdowns as Attack Attempts Surge

Some governments took websites offline as operators rushed to patch PHP vulnerabilities, while a cloud firm reported millions of hacking attempts after the flaws became public. The reports do not establish that those attempts succeeded or that the affected services were breached.

PHP released patches for multiple vulnerabilities in its core engine on October 21. The following day, reports described precautionary shutdowns affecting some banking, airline, rail, tax and government services in Europe and elsewhere.

The vulnerabilities, called “PHP2Shell” in reporting, affect PHP deployments covered by the fixes; the available information does not show that every PHP site was vulnerable. It also does not provide CVE identifiers or establish which versions and deployments remain exposed. The scale of reported attempts therefore cannot be treated as a count of successful attacks—or as proof that all attempts targeted vulnerable systems.

The response followed coordinated research and disclosure. OpenAI said its researchers, Wiz, PHP maintainers, Cloudflare and other partners contributed to the work, with PHP maintainers leading the fixes and release. Wiz independently discovered and reported both vulnerabilities, according to the research brief; OpenAI said its model identified a critical flaw. These accounts describe contributions to discovery and repair, not evidence that the reported attempts produced compromises.

The episode shows the operational trade-off in patching widely deployed software: leaving an exposed system online carries risk, while taking it offline can interrupt public and commercial services. The National Security Agency recommended that organizations inventory systems relying on vulnerable PHP versions and prioritize applicable patches.