Release advisory
PHP project
Emergency PHP releases and the original security advisory.
47 FIRST-PARTY PUBLICATIONS
The PHP2Shell response.
Read it at the source.
Original statements from researchers, maintainers, hosting providers and public agencies.
Companies & projects31
The maintainers, researchers and providers responding to PHP2Shell.
Original research
Wiz
Original research into the PHP runtime flaws and attack paths.
Coordinated disclosure
OpenAI
Coordinated disclosure with PHP maintainers, researchers and providers.
Protection update
Cloudflare
WAF response, observed attack traffic and PHP patching guidance.
Platform response
Laravel
Cloud, Forge and Vapor instructions for the PHP security release.
Service notice
OBS Project
Announced partial website downtime ahead of the PHP disclosure.
Service notice
AniList
Announced a precautionary website and API shutdown pending a fix.
Project advisory
Drupal Security Team
The Drupal Security Team’s own PHP security announcement.
Research & advisory
Aikido Security
An alert on PHP2Shell and coordinated patch preparations.
Distribution update
AlmaLinux
Backported PHP fixes and updated AlmaLinux packages.
Hosting response
Automattic
A protection update for its hosting platforms and PHP guidance.
Research & advisory
Bitsight
An exposure assessment and PHP vulnerability alert.
Distribution update
Canonical / Ubuntu
Canonical’s PHP package fixes for supported Ubuntu releases.
Research & advisory
Cisco Talos
PHP update guidance and Snort detection coverage.
Detection release
Corelight
Open-source Zeek and Suricata detections for defenders.
Research & advisory
CrowdStrike
Detection and visibility guidance for the PHP vulnerabilities.
Hosting response
DreamHost
A dated hosting response update on PHP2Shell protections.
Research & advisory
Endor Labs
Guidance to find affected PHP deployments and update.
Research & advisory
Huntress
Early guidance on inventory, patch preparation and monitoring.
Research & advisory
Imperva
Analysis of the PHP flaws and defensive guidance.
Hosting response
Mijndomein
A first-party notice of precautionary service shutdowns.
Hosting response
Namecheap
A hosting status notice on deploying patched PHP versions.
Research & advisory
Palo Alto Networks / Unit 42
Unit 42 threat assessment and patching recommendations.
Research & advisory
Patchstack
A runtime security alert for PHP website operators.
Research & advisory
Sansec
Why the fix belongs at the PHP runtime and hosting layer.
Research & advisory
Sonatype
Why PHP inventory and clear patch ownership matter.
Research & advisory
Tenable
A technical FAQ covering the emergency PHP release.
Maintainer response
The PHP Foundation
How PHP’s maintainers coordinated fixes and the emergency release.
Research & advisory
TryHackMe
A threat alert distinguishing verified facts from exploit claims.
Research & advisory
watchTowr
Research updates, reproduction and PHP patch guidance.
Research & advisory
Zafran
A research overview of the flaws and emergency update schedule.
Public agencies16
Official security notices from national and public-sector organizations.
Government alert
CISA
Calls for immediate PHP patching and taking affected systems offline when they cannot be updated.
Federal warning
FBI Cyber Division
Urges immediate PHP updates or taking unmitigated systems offline.
Government warning
NSA Cyber
Urges PHP updates or taking unmitigated systems offline.
Government advisory
CERT-EU
Security Advisory 2026-018: critical PHP vulnerabilities.
Government advisory
NCSC Netherlands
Urgent Dutch guidance on the two critical PHP flaws.
Government alert
NCSC United Kingdom
Calls for immediate updates and mitigation of PHP systems.
Government warning
GovCERT.CZ
Czech national warning about both critical PHP2Shell flaws.
Government alert
ASD’s ACSC
Australia’s alert on critical PHP vulnerabilities.
Government warning
BSI Germany
Urged security updates for critical PHP vulnerabilities.
Government bulletin
Canadian Cyber Centre
Security bulletin AV26-1070 on PHP updates.
Government warning
CERT Polska
Warning 196/2026 on PHP remote code execution.
Government alert
CERT-FR / ANSSI
France’s national alert on multiple PHP vulnerabilities.
Public statement
Dutch judiciary
Announced two websites taken offline as a precaution.
Government alert
GovCERT.HK
High-threat security alert A26-10-36.
Government notice
IPA Japan
Notice to prepare for PHP’s critical security release.
Public-sector alert
NHS England
Cyber Alert CC-4875 on the PHP2Shell vulnerabilities.
No matching organizations. Try another name or choose all sources.
Publications dated 20–21 October 2026; some describe the situation before patches were released. Logos identify the cited sources; no endorsement or affiliation is implied. Source data · Logo credits
Start with the inventory
Start with your
PHP project.
Open your codebase, copy the brief and review the migration plan.