The Netherlands' National Cyber Security Centre (NCSC-NL) said Friday that attacking the two critical PHP flaws known as PHP2Shell is more complex than it first thought, making large-scale abuse less likely. The agency has one report of possible abuse abroad and no confirmed successful attack. For organizations, the immediate pressure is easing. But the episode is not over: firewall fixes from Palo Alto Networks are still days away, and experts told Reuters that AI-assisted bug hunting will bring more emergencies like this one.
The Primary Wire reported Thursday that exploit attempts began Oct. 17, four days before patches, and that Palo Alto had no fix date. What is new is a first official reassessment of the risk, fix dates from Palo Alto and a third, lower-risk PHP issue.
What Happened
In an Oct. 23 update to its alert, NCSC-NL said further research shows exploitation is complex and that the new PHP releases appear to work well. Its advice is unchanged: install the updates on all websites, applications and network devices as soon as possible, and ask hosting providers or IT suppliers to do so where they run the systems. The agency had briefly taken its own website offline when the flaws were disclosed Oct. 21.
The PHP project published an informational advisory the same day on a further flaw, CVE-2026-115560, in how PHP tracks file-upload progress. It calls remote code execution through it unlikely because it requires an unusual configuration. A fix will come in the next regular release; until then, PHP suggests turning off the upload-progress setting.
Security companies describe heavy probing but no confirmed break-ins, SecurityWeek reported Friday. Sophos said it stopped an attempt to install malware it believes is a variant of Mirai, a family of code that hijacks devices for botnets, and it withdrew an earlier report of a successful exploit. Hunt.io and Wordfence report no confirmed compromises, and Sansec now says public exploits fail against PHP's default settings.
The counterweight: VulnCheck built an exploit for CVE-2026-109618 that gets past ASLR, or address space layout randomization, a defense that shuffles where a program sits in memory so attackers cannot predict where to aim. It works on servers built on the common x86-64 chip design, with ASLR switched on and PHP's error display turned off, a recommended production setup, and VulnCheck offers it only to paying customers, according to SecurityWeek.
Palo Alto's advisory, updated Oct. 23, now lists estimated hotfix dates for its PAN-OS firewall software and Panorama management console from Oct. 26 to Oct. 30. Fixes for WildFire WF-500 appliances remain "ETA TBD." The company says it knows of no malicious exploitation against its products. As of Friday, the Cybersecurity and Infrastructure Security Agency had not added either original flaw to its Known Exploited Vulnerabilities catalog.
Why It Matters
The disruption was real even without confirmed compromises. UK tech minister Baroness Lloyd of Effra told the House of Lords on Oct. 22 that 32 government services were unavailable and four partly unavailable, mostly as a precaution, The Register reported. She said the government was not aware of any confirmed compromise of central government systems, and later extended that to the wider public sector.
The exposure is also long-lived. Qualys estimates, cited by SecurityWeek, put about 110 million PHP instances, or 71%, on versions past end of life and 44 million more on supported versions not yet patched.
Boards should expect more of this. Seven cybersecurity professionals told Reuters that AI-driven discovery will likely cause similar disruptions. Cloudflare Chief Executive Matthew Prince said he knows of "a bunch of additional severe vulnerabilities that are present in other pieces of critical software." VulnCheck, in research it has not yet published, finds AI helped double the number of flaws found year on year, Reuters reported. Others, including curl lead developer Daniel Stenberg, said AI-found bugs tend to be exotic and hard to turn into working attacks.
What to Watch
- Whether Palo Alto meets its Oct. 26 to Oct. 30 hotfix dates and sets one for WildFire WF-500 appliances.
- Any confirmed compromise, and whether CISA then adds the flaws to its catalog.
- VulnCheck's report and PHP's full advisory on CVE-2026-115560 with its next release.
- The UK's Cyber Security and Resilience Bill, which returns to the Lords Monday amid questions over why central and local government sit outside its duties.
