PHP2Shell vulnerabilities
A flaw in the software behind most websites sends governments offline
Councils, police and ministries took websites offline as a flaw in PHP, the web's most common server language, leaked before its fix.
Timeline
PHP2Shell vulnerabilities
The critical flaws in the PHP programming language disclosed in October 2026, which led governments and companies to take websites offline while they patched.
Timeline
Security audit of PHP finds the first signs of the flaw later called PHP2Shell
Researcher working under OpenAI's Patch the Planet programme reports a remote code execution flaw in PHP
Amazon's decoy servers record the first attempt to exploit PHP2Shell, four days before disclosure
A flaw in the software behind most websites sends governments offline
PHP releases emergency fixes for the PHP2Shell flaws as governments take websites offline
A flaw in the software behind most websites sends governments offline
PHP discloses a third, lesser flaw without an emergency fix
A flaw in the software behind most websites sends governments offline