PHP2Shell flaws force cyber.gov.au and other government sites offline
Two critical PHP bugs prompted Australia's cyber security agency and several overseas government bodies to pull websites after patches were released on 21 October 2026. The disclosure was disrupted by a leak and an early release by Chainguard.
The website of Australia's cyber security agency, cyber.gov.au, went offline after the disclosure of PHP2Shell, a pair of critical vulnerabilities in PHP. Government sites in France, Finland, Denmark and the Netherlands were also taken down, as was the Port of Rotterdam. W3Techs says PHP underpins roughly 70 per cent of sites where it can identify the server-side language, and the affected software includes GovCMS, the Drupal platform behind much of Australia's federal web presence.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and each scores 9.2 under CVSS v4.0, although watchTowr scored them 10. One involves memory corruption when a request exceeds PHP's memory limit, the other involves a worker reusing stale state after memory has been freed. Together they allow remote code execution without authentication, and can expose server memory containing credentials. CrowdStrike says it confirmed that one anonymous POST request was enough to make an Apache mod_php worker start a shell. Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on 21 October, while the PHP security team has issued limited backports for some older branches that are no longer supported.
The disclosure had been planned for 22 October but unravelled. The CVE numbers leaked on 20 October, so PHP moved its release forward a day. Calif then accidentally posted a video of its exploits, and Chainguard published patched container images more than six hours ahead of schedule on 21 October. The PHP Foundation said Chainguard "unilaterally broke the embargo". Chainguard chief executive Dan Lorenc said he decided to release early because exploits were appearing in the wild, in his words: "I made the call to get these out early when exploits hit in the wild." Amazon Threat Intelligence says its honeypots recorded an exploitation attempt on 17 October, and Cloudflare and Patchstack have also reported attacks.
The Australian Signals Directorate's ACSC issued its highest-rated alert on 21 October, saying every PHP version from PHP 5 onwards may be affected and that it knew of no active exploitation at that point. That night cyber.gov.au and other federal sites went dark. A spokesperson for Home Affairs Minister Tony Burke told the ABC that the National Office of Cyber Security was aware of "disruptions to several Australian websites". A second ACSC alert on 22 October confirmed patches were available and urged organisations to apply them and watch PHP applications for suspicious activity.
The database engines themselves are not affected, so MySQL and SQL Server need no patch for these CVEs. But PHP holds database credentials in memory, so an attacker who gains code execution or reads leaked memory can usually read, alter or dump the data behind a site.
OpenAI says its models found the bug, and OpenAI President Greg Brockman said it had sat in PHP for 14 years. Wiz Research found both flaws independently, and Calif used an OpenAI model to find a version in August. The PHP Foundation acknowledged the out-of-memory problem was first spotted in 2024 during a Quarkslab audit, and calls the delay "a structural failure, caused by both the security team's decision process and its lack of resources." Tenable classes PHP2Shell as a Vulnerability of Concern, its highest level.