PHP2Shell refers to two vulnerabilities in core PHP that can allow unauthenticated remote code execution. Successful exploitation can run code with the web worker’s privileges; sensitive process memory may also be exposed. [2]
Unpatched PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP identifies mod_php as the highest risk; exploitability depends on the deployment. [1]
21 October 2026. Affected deployments, fixed releases, vendor backports and remediation guidance.
Technical impact, exploit conditions and CVSS 4.0 severity ratings.
This is a dated summary, not a live incident feed or a vulnerability assessment of your server. Consult the linked advisories for updates.
On 21 October 2026, Swiss authorities, universities and service providers restricted web services while responding to PHP2Shell. The examples below document precautionary shutdowns and restrictions, with links to operator notices and established Swiss reporting.
According to Keystone-SDA reporting published by SWI swissinfo.ch, the canton’s crisis team took PHP-based cantonal web services offline as a precaution. The Presidential Department said no security incident linked to the vulnerability had been registered at that point.
SWI swissinfo.ch / Keystone-SDA DEIT Services first suspended selected services, including the ADAM learning platform and TYPO3 logins. A later notice announced a temporary block on incoming web traffic, with explicit exceptions including the main university website, email and VPN.
MTF reported taking selected customer PHP services offline at 13:00. Its 22:50 update reported patched services restored, while noting exceptions for individual customer systems on older PHP versions, where additional protections and some functional restrictions remained.
MTF service updates DEIn its own coverage, watson reported that its IT team restricted the site to protect against possible attacks until the vulnerability could be fixed. It noted possible effects on commenting; this was a restriction, not a claim of a complete shutdown.
watson’s account of its response DEReading these examples: a precautionary shutdown does not establish that a system was compromised. These are dated reports of actions taken, not a live availability check or an exhaustive list of Swiss organisations. Times are reproduced as shown in MTF’s notice.