PHP2Shell: WordPress, Magento, Drupal and the Hosts and Sites Caught in the Blast
Researchers confirmed code execution on a long list of PHP apps, some governments and hosts pulled services offline, and one count has about 884,000 hosts advertising end-of-life PHP.
Outspoken Digest Technology Desk
Thursday, October 22, 2026/3 min read
When a flaw sits in the language underneath an application, the list of exposed software is the list of everything built on it. PHP2Shell, the pair of critical bugs in PHP patched on 21 October, is such a flaw, and the first day showed both the breadth of the exposure and the blunt instruments people reached for. Our explainer covers how the bugs work.
The headline numbers are large but they measure reach, not damage. Wiz Research puts PHP at roughly 70 percent of websites, and Tenable cites W3Techs for 69.3 percent of sites whose server-side language is known. Neither figure means that share of sites is vulnerable.
Which apps are exposed to PHP2Shell?
Calif, one of the research teams credited with the find, says it confirmed pre-authentication code execution against WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS, according to its write-up. Sansec, the e-commerce security firm, adds that Shopware and WooCommerce stores are affected even when their own code is clean, in its research note.
Red Hat urges a more measured reading. Its CVE page says standard RHEL deployments use PHP-FPM, whose workers exit on early failures, and that code execution is hard in practice. Wiz and Calif disagree about how hard, and a lab result on one stack does not transfer cleanly to another.
Which sites and hosts went offline or moved fast?
Several went dark on purpose. Patchstack's alert lists, as precautions before the patch, DigiD and MijnOverheid, the Dutch House of Representatives site, Tweakers and the Dutch national cyber agency's own site, citing NOS for the Dutch cases, along with The SEO Framework, whose developers said they took their servers offline. Sansec names Tweakers, the House, the NCSC and Security.NL. Newsweek reported that Wikimedia took some systems down and that Finnish and French government services were affected, citing Reuters and Yle.
The University of Washington took a different route. Its IT service-status page says security staff were isolating machines running vulnerable PHP by null routing, which blocks all traffic to a machine without shutting it down. Departmental, student and managed sites were listed as patched and back, and owners of isolated systems had to reply to a ticket with their PHP version before the block was lifted, per the UW-IT notice.
Hosts split between protected before release and patching as fast as they could. Automattic told customers of WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr there was nothing to do. Hetzner's status page shows an incident opened at 13:04 Central European Summer Time on 21 October, the update rolling out within minutes of release, PHP 7.4 and 8.0 to 8.5 patched on web hosting by 19:50, and PHP 5.6 and 7.3 patched by 06:32 on 22 October, with older backports still in progress.
How many servers have no fix at all?
Estimates vary with how they count. Mallory, via Greenbone's summary, counted around 884,000 internet-facing hosts advertising PHP 8.1 or older on 20 October, about 59 percent of roughly 1.5 million hosts that reveal a version. Greenbone stresses these are banner counts, not confirmed vulnerable systems. Recorded Future cites VirusTotal for about 758,000 addresses on end-of-life branches out of 1.1 million that disclose a version. Tenable relays other estimates of 1.3 million to 1.9 million exposed PHP hosts.
Many of those hosts may run patched packages. Linux vendors backport fixes without changing the version string, so a banner reading 7.4 can hide a fixed build. Ubuntu lists fixes for releases back to 14.04 through its paid extended-support programme, for example, and PHP's own team published only minimal source backports for 7.4, 8.0 and 8.1.
The questions now are practical. Which of those machines will be patched, rebuilt or switched off this week, and how long before the stragglers become the next target list? Our guides for site owners and hosts and security teams cover the next steps.
Published in The Outspoken Digest
Editorial desk
Outspoken Digest Technology DeskSoftware, hardware, artificial intelligence and what they change for everyone else.
Newsletter
The Digest, in your inbox
One edition, sent when it is ready. No noise, and your address is never passed on.
Read Next
More Technology →
What PHP2Shell Reveals About Maintaining the Code Behind Most of the Web
Oct 22, 2026/3 min read
PHP2Shell for Hosts, Developers and Security Teams: Backports, WAF Rules and Incident Response
Oct 22, 2026/3 min read
PHP2Shell: What Website Owners and Small Businesses Should Do Right Now
Oct 22, 2026/3 min read
PHP2Shell Timeline: From a Quiet August Report to a Leak, Early Attacks and a Day-Early Patch
Oct 22, 2026/3 min read