Palo Alto retracts claim that PHP2Shell "apocalypse bug" was used to attack Europe

Palo Alto Networks has withdrawn a report alleging that the PHP2Shell vulnerability dubbed an "apocalypse bug" has been exploited in attacks against an unnamed European government entity.

In an update published on Sunday, October 25, the security giant said it could no longer establish that the horror vuln was used in the European government attack after warning that 22.6 million exposed instances were potentially vulnerable to a pair of critical CVEs impacting the programming language PHP.

Last week, governments and businesses pulled down their websites amid fears that CVE-2026-109618 and CVE-2026-109619 (both with a CVSS rating of 9.2) were about to break the internet, enabling attackers to execute malicious code remotely without authentication.

The bug was discovered using OpenAI's latest model - prompting concerns that agent swarms could be unleashed at a scale that defenders would be unable to deal with.

PHP powers a vast proportion of the web, including popular content management systems such as WordPress, Drupal and Joomla.

At the time of writing, the internet remains standing and the so-called vulnpocalypse remains on the horizon - although it certainly feels closer than it did a few weeks ago.

Palo Alto Networks' Unit 42 wrote: "We reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities.

"What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application.

"This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23."

Warnings about PHP2Shell prompted emergency responses from governments and technology companies around the world. In Britain, ministers revealed that 32 government services had been taken offline and four more were partially unavailable, largely because of precautionary measures while fixes were applied.

The National Cyber Security Centre also issued 50,000 notifications to organizations ahead of the public disclosure.

Anatomy of the apocalypse vulnerability

Cybersecurity researcher Ryan Austin, known as Ryan A., at security firm Calif, identified an exploitable attack chain in August 2026 as part of its Patch the Planet initiative.

His findings demonstrated the remote code execution potential of memory-management flaws that the PHP Foundation had first identified in 2024 but had struggled to fix.

OpenAI's own researchers and cloud security company Wiz Research independently identified related vulnerabilities and attack techniques using AI, deploying Google's Gemini 4 Argon, GPT-5.6 Sol, and its proprietary Wiz Atlas tool to discover the flaws, develop working exploits, and test the patches.

Dan Bird, EMEA Field CTO at Horizon3, said: “Part of the flaw behind PHP2Shell was first spotted years ago, but because exploitation wasn’t understood, it was left unfixed.

"AI tools have changed that, finding a practical way to turn the flaw into a potent exploit. The same tools are available to adversaries, and they were already probing for targets at machine speed before the patch was released. With PHP running so much of the web, attackers know that companies slow to react will be wide open, and even those that have patched might not have done so widely enough."

The age of the vulnerability may actually increase the risk, warned Phillip Wylie, Chief Security Evangelist at Suzu Labs:

“One of the biggest challenges with vulnerabilities this old is that the people who originally deployed and maintained these systems may no longer be with the organization," he said.

READ MORE: Ancient UK water systems face a modern security threat that's worrying business leaders

CVE-2026-109618 is a remote code execution vulnerability caused by improper handling of out-of-memory (OOM) errors. When the longjmp() function interrupts normal control flow, request memory can be left uninitialised, allowing attackers to trigger OOM conditions and reliably execute malicious code.

CVE-2026-109619 is a remote code execution vulnerability in which fatal error handling through longjmp() leaves global memory references pointing to freed memory regions. Subsequent requests can access these regions or make control-flow decisions based on their contents, potentially allowing attackers to execute arbitrary code.

Niv Lanyado, JFrog Security Research team lead, said: "This flaw triggers inside the core PHP engine before any application code executes, traditional application-level safeguards won't stop it. Organizations cannot rely on code-level workarounds."

Sophos backpedals

Palo Alto is not the first major cybersecurity company to retract a report of successful exploitation.

On October 22, Sophos reported that its researchers had identified multiple attempts to exploit PHP2Shell, including one successful attack involving malware associated with the Mirai botnet.

The original announcement, published at 16:18 UTC, claimed attackers had delivered malicious code to a compromised PHP system.

Just over five hours later, at 21:21 UTC, Sophos reversed its assessment.

Further examination of customer telemetry revealed only "scanning and a small number of failed exploitation attempts," the company explained.

"The payload, a likely Mirai botnet variant known as Potassium, was not delivered," Sophos added, explaining that its security countermeasures had blocked the attempt.

The malicious code included functions to download additional Linux malware, communicate with an encrypted command-and-control server and perform distributed denial-of-service attacks.

The company also admitted that producing a reliable exploit had proved difficult. Its adversary research team struggled to identify a successful attack path, even with assistance from artificial intelligence.

The failures suggest that cybercriminals attempting to exploit PHP2Shell may be encountering similar obstacles.

Why hasn't PHP2Shell broken the internet?

We haven't seen a wave of successful compromises yet, but that doesn't mean attackers have been sitting around doing nothing.

Amazon reported an exploitation attempt against its MadPot honeypot infrastructure on October 17, four days before the vulnerabilities were publicly disclosed.

It recorded additional attack bids on October 21, before official patches became available, with varying payloads and infrastructure suggesting multiple actors were involved.

Amazon acknowledged that it could not establish whether those attempts would have succeeded against real-world systems.

Cloudflare also observed widespread malicious activity, including attackers modifying payloads to evade web application firewall protections.

The company had deployed protective rules across its network before the public disclosure, helping shield websites while administrators applied security updates.

Yet on October 23, CrowdStrike reported that its researchers observed no successful real-world exploitation in their monitored environments or honeypots, noting "only testing, probing, and unsuccessful exploitation attempts."

The problem for attackers is that demonstrating memory corruption in a laboratory is very different from turning it into a reliable weapon against millions of different production systems.

Successful attacks may depend on the precise PHP version, server configuration, supporting libraries, and application environment.

Memory protections such as address space layout randomization, which makes memory locations harder to predict, create further difficulties for attackers attempting to execute arbitrary code.

However, these defenses are not insurmountable.

VulnCheck researchers demonstrated an exploit capable of overcoming address space layout randomization on an x86-64 system using a production-style configuration. Other researchers have reproduced remote code execution in controlled environments.

The PHP Project has released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while older unsupported installations require appropriate vendor fixes or upgrades.

A further vulnerability, CVE-2026-115560, was disclosed on October 23, although the PHP Project says exploitation requires an "unusual combination of configuration and application code".

READ MORE: French fridge hacks expose cold truth about a growing systemic risk to global supply chains

The threatened PHP apocalypse has not arrived.

But the technical danger remains, and a reliable exploit targeting a widely deployed PHP configuration could still change the picture dramatically.

Oliver Simonnet, Lead Cybersecurity Researcher at CultureAI, warned: "PHP2Shell is a clear example of how little time we now have as defenders to secure our environments in the age of AI. In a world where these types of vulnerability discoveries may become commonplace, and details being leaked before formal disclosure, exploits created exceptionally fast, and attackers exploiting the issue in the wild rapidly before fixes are even available."

And John Strand, Owner, Black Hills Information Security, said: “These PHP vulnerabilities highlight two problems. First, releasing a patch doesn’t mean we can fix everything overnight. PHP is embedded in all kinds of devices, including IoT products, where updates may depend on a vendor. And plenty of small businesses use PHP applications because they’re easy to get running. That doesn’t mean those businesses have the staff or technical expertise to keep everything updated.

“Then you have application compatibility. Plugins and other dependencies can require specific PHP versions, so updating the underlying software may break something the business relies on. ‘Just patch it’ sounds great until the update takes down your website.

“And we haven’t even gotten to the AI-assisted vulnerability research behind this. I think we’re going to see more critical vulnerabilities discovered with AI, and potentially less time between discovery and exploitation."

Follow Machine on LinkedIn