SCWorld.com reported that “The Cybersecurity and Infrastructure Security Agency (CISA) advised all organizations running PHP-based websites to apply the patches released by PHP right away.” The October 21, 2026 article entitled “CISA advises orgs to patch PHP2Shell bugs immediately” (https://tinyurl.com/yeyw9jcd) included these comments:
Given that nearly 70% of all websites run PHP-scripted applications, security pros agreed with CISA that this was a “patch now” moment. PHP code powers many important content management systems, such as WordPress, Drupal, and Joomla — it also runs over WooCommerce and Adobe Commerce.
Security pros expected more reports of exploits in the hours and days ahead, and point to the speed of attacks teams face in the AI era.
Roman Y. Sannikov, global research coordinator at iCounter, said PHP2Shell showed how quickly the window between disclosure and exploitation has closed. Sannikov said PHP planned an orderly release, but the CVE IDs were posted on Hacker News before the patches shipped, watchTowr said it has already reproduced one of the two flaws, and Cloudflare said it’s already seeing early attack attempts.
“Attackers don’t need a public proof of concept to start working,” said Sannikov. “They scan the internet for PHP servers now and build their target lists, so when technical details land, they are ready to exploit on Day 1.”
Sannikov said defenders should treat today’s patches as urgent and start with internet-facing systems, including the older PHP 4, 5, 7, 8.0, and 8.1 sites that tend to get forgotten. He pointed out that cursory research by Modat shows almost 80% of PHP sites use versions that are no longer supported, and thus will not have been patched.
“WAF rules and the workarounds circulating online can buy time, but none of them are verified, and PHP’s own developers say patching is the only real fix,” said Sannikov.
Andrew Obadiaru, vice president and CISO at Cobalt, said once an embargo breaks, the disclosure timeline stops belonging to defenders.
Please get patches for your website!