Leaked PHP2Shell Flaws Force Emergency Patch and Global Service Shutdowns

PHP runs on the backend of about 69.4% of websites, including sites built with WordPress, Drupal, Joomla and MediaWiki, the report said. In Japan, where the technology is used by 92% of websites, Sanae Takaichi posted a message urging site administrators to apply the patch. Government and academic institutions in Europe took services offline, and niconico, pixiv, Uma Musume, Granblue Fantasy and Nintendo-related game services were suspended, with some restoration times not announced. Sushiro said its mini-program was paused and would likely resume the next afternoon.

The vulnerabilities allow remote code execution in the worst case, letting an attacker run arbitrary code on a server, steal user data, alter news content or redirect e-commerce payments, and install ransomware or use the server as a foothold for further intrusion. Sites and services chose to go offline until patched, the report said.

Not all operators can patch. Nearly half of websites use PHP versions that have reached end of support and will not receive fixes, according to the report. Cisco, WatchTowr and 360 security teams reproduced the attack from public information before the patch was released, and Cloudflare observed small-scale attacks.

The flaw was first noticed in 2024 during an external security audit, when PHP maintainers saw a memory-exhaustion issue, the report said. It was not fixed because no stable exploit had been found and changes to core code could affect compatibility. In June 2026, OpenAI launched a security project called Patch the Planet with security companies to use AI to find and report vulnerabilities in open-source projects. Calif researchers found a way to exploit the 2024 flaw in less than two months, and Wiz Research independently found the same flaw using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.

Wiz described the PHP flaws as among the most severe in software history and said exploitation was almost beyond what human researchers could achieve, according to the report. After a viable attack method was found in August, the PHP team made the fix a top priority and worked with OpenAI and a group of security companies to develop the patch in secret, allowing it to be released after the leak.

OpenAI said in a blog post that the flaws were among several important vulnerabilities it had found and was helping fix, and that it expected similar discoveries to increase sharply in the coming months, the report said. The PHP Foundation, which provides the technical base for most websites, reported US$730,000 in donations in 2025 and had 11 full-time and part-time contracted developers, who made about 42% of commits to PHP's core codebase that year.