All over the media: The PHP2Shell vulnerability—but the danger isn’t over yet
You’ve probably read about it in the news: The recent PHP security vulnerabilities caused major chaos on the Internet on October 21, 2026: Hospitals such as Inselspital Bern and the University Hospital of Zurich, as well as cantonal websites and entire hosting providers like Cyon in Basel, even had to suspend their services partially or entirely.
Now, on October 22, 2026, it has come to light that systems were already under attack as early as October 17, 2026—four days before the official PHP security update was released. On October 17, Amazon detected an exploit attempt on one of its web servers—four days before the security updates were released. That’s very concerning.
PHP2Shell was apparently already being actively targeted before its official release. On October 21, as expected worldwide, there were numerous attacks targeting the vulnerabilities, which were systematically exploited. Critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2, where 10.0 is the highest score. This illustrates just how critical the security threat was—and possibly still is.
We should also assume that these security vulnerabilities could have led to successful attacks as early as October 17, 2026. A particular concern is that successful attacks can remain virtually undetectable. Standard Apache and PHP logs may not show any anomalies. Millions of servers could be affected: Older versions of PHP that no longer receive regular security updates are particularly vulnerable.
What is the reason behind the surge in attacks? Why now, of all times?
AI Accelerates Attacks: Security researchers warn that attackers can use AI to quickly develop working attacks—known as exploits—that take advantage of security vulnerabilities based on publicly released patches.
What does this mean for your servers?
It is important to understand that an attack on your systems may have already occurred. That is why post-incident audits and analyses are absolutely essential. The following measures should be a priority:
Switch to the patched PHP versions
It is absolutely essential that you update to the latest PHP versions. Do this immediately and with the highest priority—preferably by October 21, 2026, or as soon as possible thereafter.However, there is still a risk of an attack even after the updates:
. A compromise prior to the update cannot be ruled out, as attacks were already observed on October 17.
- Check whether an attack has already occurred at
. Log analysis can help—but is not sufficient—to rule out the possibility that a web server has been compromised. Sometimes, even an inconspicuous memory limit error in the web server error log can be a clear indication that a successful attack has already occurred. Other indicators include: unusual PHP processes, outbound connections, and newly created files.
