PHP2Shell: how one hole in PHP scared half the world — and what it means for us

Imagine that the foundation on which half of all sites on the Internet stand suddenly cracked. This is exactly what happened at the end of October 2026, when a critical vulnerability called PHP2Shell was found in PHP, the programming language on which a huge part of websites, public services and banking portals work. The hazard rating is 9.2 out of 10. Simply put: almost the maximum score. As a result, the noise turned out to be half the planet.

What happened at all

On October 21, PHP developers released an emergency update. The hole turned out to be so serious that even a neatly written application did not help protect against it — the problem was in the PHP engine itself, and not in a specific site. It's as if the lock was good, but the door broke along with the hinges.

Further events rushed rapidly.

As a precautionary measure, the Netherlands has disabled the national digital identification system DigiD, the public services portal, the parliament website, the port of Rotterdam and some hospital and transport services. Japan suspended the work of the tax service for several hours, followed by the websites of the Ministry of Finance and large companies like Nomura, MUFG and ANA. Russia sent a directive through the FSB: who can't update PHP urgently — physically close access to your servers from the Internet.

An indicative detail: even the hackers themselves were scared. On Wednesday, October 21, the world's largest darknet sites — the BreachForums and Dread forums — voluntarily closed. Traders of stolen databases understood a simple thing: their own servers run on the same leaky PHP, and competitors will now open them without any passwords.

Why is it serious

The main problem with PHP2Shell is that the attack is silent. When a bot siphons data through this vulnerability, the site does not hang or crash. He calmly replies "200 OK" and works on. The owner may not know for months that he has already been robbed.

And very valuable things are pumped out of RAM. While the portal is running, data is spinning in memory, which is stored only in encrypted form on the hard disk:

• live tax returns and VAT refund registers;
• lists of beneficiaries of companies and cross-border transfers; session keys of accountants;
• digital "casts" of sessions and two-factor authentication keys.

The latter is the most insidious. Having such a cast, the hacker does not need your password and he does not need to intercept SMS. He simply logs into the system under the guise of an already authorized official or businessman.

The story of "AI in two hours"

There is a version circulating on the web that between October 23 and 25, a certain autonomous AI agent himself, without human intervention, hacked the internal network of the European ministry in two hours - pulled out passwords, bypassed two—factor protection, laid hidden channels and completely captured the main server. And that the handwriting points to the North Korean group Lazarus.

However, this particular story was not directly confirmed in authoritative sources. Reports mention that attack scripts could be generated using AI and that automation of attacks is growing. But the statement "AI hacked the ministry in 120 minutes, and it's definitely Lazarus" remains at the level of an unverified version. Perhaps true, perhaps an exaggeration. Keep that in mind.

Russia: The FSB said to turn everything off

This is the toughest official reaction among all countries. On October 22, the National Computer Incident Coordination Center (NCCCI) under the FSB of Russia sent a directive to the owners of critical information infrastructure facilities (government agencies, finance, energy, transport, communications, healthcare, etc.) through the GosSOPKA system. First of all, PHP needs to be updated to the corrected version (8.2.35, 8.3.36, 8.4.27 or 8.5.12). If the update is not possible, consider temporarily restricting external access to vulnerable web servers until they are turned off. After the update, perform an antivirus check of the servers, examine the logs for signs of hacking, and if suspicious activity is detected, report it to GosSOPKA.

The background is also indicative: according to W3Techs, 90.8% of Russian—language websites run on PHP (the global figure is 69.3%). According to Bi.Zone estimates, there are about 50 thousand potentially vulnerable PHP web applications in the Russian segment of the Internet. Some Russian companies have already warned customers, Kaspersky Lab and 1C-Bitrix have also published recommendations.

Kazakhstan did not demand, but recommended

KZ-CERT (National Computer Incident Response Service of Kazakhstan) issued an official warning on October 22, confirming that two PHP2Shell vulnerabilities have a danger rating of 9.2/10 and affect WordPress, Laravel, 1C-Bitrix, Magento, Drupal, Joomla and other platforms. Key recommendations:

• upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart server processes;
• as a temporary measure: disable tracking of download progress, limit the size of incoming requests, strengthen monitoring of logs.

At the same time, KZ-CERT did not report confirmed mass hacks of state information systems, banks or large Internet services in Kazakhstan.

Compared to the Russian directive on "disconnection", Kazakhstan's warning is more focused on "updating + monitoring", with a softer approach. The controversies mentioned in your previous text around PHP 7.4.33 sites (ortcom.kz , bolashak.gov.kz ) did not receive official confirmation or denial in the search results.

In JSC "NIT" journalists were briefly told what kind of eGov.You don't have to worry about kz — everything is protected there. At the same time, journalists of the Polites News resource ran 15 large Kazakh state and quasi-state websites through an external scanner. According to their data, all fifteen work in PHP. Thirteen at least hide technical information about themselves. And two — the website of the Central Communications Service (ortcom.kz ) and the Bolashak Scholarship website (bolashak.gov.kz ) — openly showed their stuffing: PHP version 7.4.33. Support for this version was officially discontinued back in November 2022, and there is no ready update for it.

There are no reports about the official reaction of Ukraine, Belarus, Uzbekistan, Kyrgyzstan, Armenia and other CIS countries to PHP2Shell. However, this does not mean that they did not react. There must have been a reaction. It's just that we haven't found any information about it.

What's next

If you believe the same version of events, the attack began on October 17 — four days before the release of updates. This means that everyone who was sitting on older versions of PHP without expensive multi-level protection stood for almost a week with "open memory" in front of a swarm of automatic scanners.

In Europe and Japan, the departments themselves extinguished the sites, because their defense saw the assault begin. Apparently, no one touched the switch with us.

Then — according to the classic scenario: the pumped terabytes of data are checked and packed. First, the owners of the bases will be offered to quietly redeem their secrets. And everything that won't be paid for will start surfacing on the darknet and in investigations in a couple of weeks.

In general, the vulnerability, as it turned out, is real and serious. This is confirmed by emergency measures of governments of various countries. The story about "AI in two hours and Lazarus" has not yet been confirmed, and therefore it should be treated as a version, not a fact. The data for Kazakhstan is from one source, there is no official verification. But the question "what version of PHP are Kazakh state sites sitting on?" is worth asking. The most dangerous thing is noiselessness. The site can work as if nothing had happened, and the data has already leaked.

And, probably, it would be good to check the PHP version. If it is old and there is no update, apparently, you should close access from the Internet, as advised in the directive. After all, an inconvenience is better than a leak.