When PHP2Shell hit, one G7 government asked Red Sift for every exposed host across its national estate, and got the list with every host mapped to the department that owns it.
Two critical flaws in PHP put every version since PHP 5 in scope. Governments everywhere had the same question: where do we run PHP? Most reached for the off switch. One asked us, and had its answer for the whole national estate before the patches shipped.
This is the best data we have seen.
The PHP team gives a day's notice of an emergency fix. The CVE identifiers are online the same evening, and CERT-EU issues an advisory before any patch exists. Amazon's honeypots had already recorded a probe against the flaws three days earlier.
For anyone running government infrastructure, the problem is immediate. Every version since PHP 5 may be affected. A version filter is useless. The only safe starting point is a full list of every internet-facing host running PHP, in any version, anywhere in the estate.
Not a sample, not one department. Every department and agency the government is responsible for, resolved to named hosts. Building that list by hand means chasing asset registers, cloud accounts, suppliers and appliances that bundle PHP without saying so. That is weeks of work, and the patch window opens the next afternoon.
Red Sift Hardenize, our attack surface management (ASM) solution, continuously finds and monitors internet-facing servers and records what software each one runs. The inventory the government needed was already there. We queried it, resolved every PHP host to the department that owns it, and delivered the estate-wide list in one view, before the fixed versions were published at 13:30 UTC on 21 October.
The same scan ran across every ASM customer. Everyone directly affected received their own hostnames, the release time and the official advisories ahead of the patch.
Other vendors are telling us it is impossible to get the level of data Red Sift can provide.
The patch takes minutes. Finding every host that needs it can take weeks. The governments that moved fastest already had the list.
One government asked. Every affected Red Sift ASM customer got the same thing: a named list of its PHP hosts, before the fix shipped on 21 October. Then we measured what they did with it, every day for five days.
PHP CVE-2026-109618 / 109619 · 21–26 Oct 2026
10,114
fewer known vulnerable customer servers in five days.
Down 62%, from 16,203 to 6,089. Customer organisations with a known vulnerable server fell from 443 to 254.
Every affected customer had its named host list before the fix shipped.
redsift.comSource: Red Sift daily scans of customers' internet-facing servers; net change, 21 vs 26 Oct 2026.
On 26 October, 4,909 of the 6,089 customer servers still exposed ran PHP 8.1 or older. There is no official PHP release to install for those versions, so they need a vendor backport or an upgrade. That is where the work is now, and it starts with the same question as day one: which of your servers are they?
Could you produce this view for your own servers today? If the answer is not clear, we will send you a one-off outside snapshot of your domain.
Scope: internet-facing hosts where PHP was detected, across Red Sift ASM (Hardenize) customer instances, compared daily from 21 to 26 October 2026. Demo, sandbox and research instances are excluded. Organisations are customer instances.
Patched means the host reports 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later on the same branch; a host reporting several versions counts only if all are fixed. Known vulnerable means it reports an unfixed version on any branch. Hosts on 8.1 or older may already carry a backport that is not visible from outside.
Changes are net: a server leaves the count when it is patched, upgraded, decommissioned or stops reporting a version. About 9,185 customer hosts exposed no version on 26 October and are not counted either way. Every version since PHP 5 is affected, so treat them as potentially exposed.
Our attack surface management (ASM) solution continuously finds and monitors your internet-facing servers and records what software each one runs. When a flaw like this lands, the first question changes from "where do we even start" to "here is the list".
Before the PHP team shipped fixes, we scanned every host we monitor across our entire ASM customer base to find the ones running PHP.
We mapped each affected host back to the customer, department or agency responsible for it, so every notice was specific to one estate.
Everyone directly affected received the hostnames that may be exposed, the release time and links to the official advisories, before the fixed versions were published.
Customer notice · 21 October 2026 · ahead of the PHP security release
Announced release time: 21 Oct, 14:00 UTC. Fixed versions: 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35. Patch internet-facing hosts first and restart every worker.
Hostnames are examples. Real notices carry the customer's own hosts.
External scanning sees what a host reveals and covers the assets in your account. Internal systems, hosts outside your monitored scope and products that hide their PHP runtime still need to be checked by you.
If you are a Red Sift ASM customer and did not receive a notification, we did not find PHP on the hosts we monitor for you. We still advise cursory checks on your side.
The value is in the specificity: named hosts, in your estate, before the patch window opens.
Whatever your starting point, the first move is the same: know every internet-facing host you own and what it runs. Here is how we can help, depending on where you are.
You have had our preliminary information: the hosts we monitor for you that run PHP, with the release timing and the advisories. We are open to going further with you across the whole estate, including scope you have not yet added, and helping you prioritise the long tail of hosts that cannot be patched quickly.
If you are a national government or public-sector body and not yet using our attack surface management, talk to us. We are already producing estate-wide exposure lists at national scale, resolved to named hosts, and that data is being measured against what other vendors can provide.
PHP runs most of the web, it is embedded in products you did not build, and the attack lands before your application sees it. If you cannot say today how many internet-facing PHP hosts you have, that is the first problem to fix, and it is one we can help with this week.
Drawn from the PHP security advisory, the UK NCSC alert and our own technical post.
Start with internet-facing hosts. Do not filter by version. Include containers, base images and anything built from source.
8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package. For 8.1 and older, use a vendor backport or upgrade.
A patched binary does nothing for FPM pools or Apache children still running the old code.
Set memory_limit=-1 administratively, lower post_max_size, set session.upload_progress.enabled=0 and, on 8.5, fatal_error_backtraces=0. Restart workers again. These block the confirmed attack paths and should be treated as a bridge to patching.
CERT-EU and the NCSC both advise taking an internet-facing application offline until it is fixed.
Look for signs of compromise on anything you could not update quickly, and read vendor advisories for products that bundle PHP.
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws in the core PHP engine. They sit in the code that runs when a worker runs out of memory or hits a fatal error, so they do not depend on the application on top. WordPress, Drupal, Laravel, bespoke apps and appliance consoles are all in scope.
Any PHP installation serving web requests may be affected, across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php is the highest risk because the demonstrated exploit triggers during request parsing, before a web application firewall rule tied to application routes would see it.
Compiled fixes exist for four branches. Older branches received source-only backports or nothing. A related third issue, CVE-2026-115560, was disclosed on 23 October and is covered by the existing mitigation.
| Branch | Fixed in | Status |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Security fixes only |
| 8.2 | 8.2.35 | End of life 31 Dec 2026 |
| 8.1 · 8.0 · 7.4 | Source backports only | No compiled release. Vendor backport or upgrade. |
| 7.3 and older | None | Includes PHP 5. Upgrade. |
Fixed versions released 21 October 2026 at 13:30 UTC. Source: php.net and GitHub security advisories.
Appliances and consoles bundle it. Palo Alto Networks, Fortinet and Cisco were all assessing products within hours.
Every version since PHP 5 may be affected. The NCSC's first action: identify all systems running any version.
Around 42% of internet-facing PHP hosts run end-of-life branches with no compiled fix (VulnCheck).
A patched binary does nothing for FPM pools or Apache children until every worker restarts.
Within 48 hours, national cyber agencies on four continents told organisations to patch immediately or take systems offline. Several governments pulled their own public services first, because they could not yet say which ones were exposed.
NCSC alert and more than 50,000 direct warnings. Identify every PHP system, patch, or consider taking it offline. 32 government services were unavailable and four partially, mostly as a precaution, the minister told Parliament on 22 October. The Government Cyber Unit's basic monitoring of public-sector domains uses Hardenize, Red Sift’s attack surface management tool, which scans .gov.uk every eight hours.
Government services offline on NCSC-NL advice, including DigiD and the parliament's website. NCSC-NL maintains the public inventory of products that embed PHP.
All government public web services shut down by Valtori, the state IT agency, while patches were applied.
The Prime Minister urged site owners to prepare and consider going offline. The Finance Ministry, Meteorological Agency and National Tax Agency suspended services. JPCERT published indicators of compromise.
BSI critical warning. The federal IT centre, ITZBund, took federal websites offline as a purely preventive measure.
CERT-FR alert: isolate affected systems. The Interior Ministry took prefecture websites offline.
CISA and NSA: patch now or take the system offline. The NSA said cyber actors are likely to weaponise the flaws and called for immediate patching across US government departments and agencies.
CERT-EU advisory 2026-018 ahead of the patches, followed by a joint statement from the Commission, ENISA, CERT-EU and Europol.
Cyber Centre alert AL26-026. Some Government of Canada websites were temporarily unavailable; the alert was updated on 23 October for the third CVE.
ACSC critical alert: act now. Identify PHP systems, monitor for malicious activity, patch as updates arrive.
Taking a service offline is the response of last resort, and governments on four continents reached for it within hours. That is the scale of the inventory problem, even for well-resourced teams.
Red Sift attack surface management maps every internet-facing host in your estate and what it runs, so the next critical vulnerability arrives with the answer already made.
Everything on this page is drawn from public sources as of 23 October 2026, except the results in section 02, which come from Red Sift ASM customer data to 26 October 2026. Exploitation status and exposure counts change hourly; check the primary advisories before acting on a figure.