Are we affected by PHP2Shell?

If you run PHP to serve web requests on a version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, assume so. PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as at risk, which covers most content management systems, online shops and vendor portals. If your sites are hosted for you, ask your provider which version they run.

Is a web application firewall enough?

No. Firewall rules reduce exposure while you patch, but PHP's advisory says only an update is a complete solution, and the rules cover only traffic that passes through the firewall.

What if we run PHP 7 or PHP 8.1?

Those versions no longer receive updates from the PHP project. Some Linux distributions and long-term support vendors backport fixes, and the PHP team published minimal source backports for 7.4, 8.0 and 8.1, but the lasting fix is a supported version.

Black October 2026: Events and PHP2Shell Protection

What Black October is

Black October is the name given to a cluster of attacks and urgent security fixes in October 2026, most of them between 19 and 22 October. They were not one coordinated campaign. What links them is speed: flaws found with the help of AI, exploit attempts within hours of disclosure, and attacks that reached victims through software they trusted.

PHP2Shell: the two flaws

CVE-2026-109618 and CVE-2026-109619 let an attacker run code on a PHP server without logging in. Both are rated 9.2, critical.
Who is at risk: every PHP installation serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates the risk highest for mod_php.
The fix: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older no longer receive updates.
The response: government websites in the Netherlands, Finland and Belgium went offline as a precaution, and Cloudflare's chief executive reported exploit attempts rising from thousands to millions within hours of the announcement. The Australian Signals Directorate issued a Critical Alert telling organisations to find where PHP runs.

What has changed since publication

Confirmed exploitation. CISA added both flaws to its Known Exploited Vulnerabilities catalog on 26 October, and US federal civilian agencies were told to fix them by 29 October. GreyNoise reported at least six successful exploitations, and a researcher recorded successful shell executions against honeypots on 24 October.
A targeted campaign. Security firm Dream reported that a suspected China-linked operator chained PHP2Shell with a Linux kernel flaw to take over 25 servers in the US, Japan, Taiwan and South Korea, three of them in a US government-affiliated environment. AI coding and offensive tools were found on the attacker's infrastructure, but Dream did not describe the operation as fully autonomous.
Tailored, not automatic. Researchers quoted in the reporting expect most exploitation to need an exploit tailored to each target. The fix is the same either way: update.
A wider pattern. The same weeks brought AI agent attacks on Microsoft 365 tenants and Japanese organisations. Read our guide to major cyber attacks for the full list.

How to protect PHP sites now

Find every PHP installation: websites, admin portals, intranets, vendor appliances and containers, including forgotten subdomains and test servers.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your Linux distribution's patched package, then restart every PHP worker.
If an update has to wait, apply the interim settings in PHP's advisory, such as turning off session upload progress in php.ini or the FPM pool. They reduce exposure but do not make a server safe.
Put a web application firewall in front, with managed rules switched on. Cloudflare's rules protect only hostnames that are proxied through it, not direct access to a server's address.
Check exposed servers for compromise: new admin accounts, unknown PHP files in upload and cache folders, new scheduled tasks and unexpected outbound connections. If you find any, restore from a clean backup and rotate every secret the server held.
Plan off unsupported PHP. PHP 8.2's security support ends on 31 December 2026 and PHP 8.3's on 31 December 2027. Check yours in our end-of-support tracker.

The Black October timeline

Each entry is drawn from the advisory, the organisation's own statement or the reporting listed under Sources. Counts were still being confirmed when this was written.

12 and 21 Oct 2026

GitLab

A flaw in GitLab's CI/CD engine, rated 10.0, allowed code execution without logging in. A second 10.0 flaw, affecting every version since 7.0, was patched on 21 October.

The lesson: Self-managed tools need the same patch speed as public websites.

12 Oct 2026

Ahold Delhaize

The grocery group took websites and apps for brands including Food Lion, Stop & Shop and Albert Heijn offline after a cyberattack. Stores stayed open, and online services took about eight days to return.

The lesson: Plan how you keep trading while your digital channels are down.

15 to 16 Oct 2026

Rank Math PRO for WordPress

A backdoored 3.0.123 update of the paid SEO plugin was served for about 11 hours (CVE-2026-111862, rated 9.8). Updating to 3.0.124 replaces the plugin but not what the backdoor left behind.

The lesson: A trusted update can carry an attack, so watch what changes after one.

17 to 20 Oct 2026

eMudhra certificate keys

Eight intermediate certificate authorities were found to have trivially weak private keys. Mozilla, Google, Apple and Microsoft blocked them within days, and Mozilla and Google moved to remove the root.

The lesson: Know which certificate authorities your systems trust.

19 Oct 2026

AI agents for hire

Reuters reported that one operator used Cairn, an open-source AI agent platform, to try more than 1,200 sites and reach more than 100 companies, citing research by NorForge.

The lesson: Automated probing is now cheap enough to find any gap you leave open.

20 Oct 2026

SafePay ransomware advisory

CISA, the FBI and partners warned that SafePay has hit about 600 organisations since August 2024, Australia among the countries affected, getting in through exposed credentials, VPNs and unpatched edge devices.

The lesson: Multi-factor authentication and patched edge devices close its usual doors.

20 to 21 Oct 2026

PHP2Shell

Two critical PHP flaws allowing code execution without a login were announced and patched. Government websites in three European countries went offline as a precaution, and exploit attempts ran into the millions within hours.

The lesson: Patch windows are now measured in hours.

21 Oct 2026

LiteLLM

A poisoned 1.107.0 release of the popular AI gateway library, carrying a credential stealer, was published to PyPI and Docker after its release pipeline was hijacked.

The lesson: Pin versions, and rotate the secrets on any machine that installed a bad release.

21 Oct 2026

Railway

The cloud platform said an unauthorised party accessed systems storing customer environment variables and obtained some decrypted values. It paused deployments and told customers to rotate their secrets.

The lesson: Keep the secrets a platform holds few and short-lived.

What it means for Australian organisations

Hours, not weeks. Exploit attempts now begin within hours of a disclosure, so internet-facing software needs a same-day patch or a same-day mitigation.
Trusted software is a way in. Four of the nine events reached victims through an update, a library, a platform or a certificate they relied on.
AI works on both sides. It helped find the PHP flaws and cut the cost of breaking in.
Reporting still applies. A ransomware payment must be reported to ASD within 72 hours by businesses with turnover of A$3 million or more. See our guide to major cyber attacks.

How we help

Our cyber security team finds every PHP installation you run, patches or mitigates each one, checks exposed servers for signs of compromise and plans the move off unsupported PHP, at a fixed fee agreed after a free call: ask about an urgent security response. Older PHP applications can move to a supported platform in a 30-day migration sprint.

Black October, and how to protect your PHP sites