Not yet, for the parts you write yourself. If your server runs OpenSSL 3.5 or newer, HTTPS connections that use its default settings already offer a hybrid post-quantum key exchange, but PHP's own openssl_* functions cannot do post-quantum encryption or signatures. PHP2Shell, the critical PHP flaw patched on October 21, 2026, has nothing to do with quantum computers. It does show why that gap matters.
One bug kept the PHP world busy with emergency patches for a week. Q-Day is not one bug.
What happened with PHP2Shell
On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix "two critical vulnerabilities that can allow unauthenticated remote code execution", CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 (CVSS v4.0) (php.net). Unauthenticated remote code execution means a stranger without an account can make your server run his commands. The security press nicknamed the pair PHP2Shell. PHP says the risk is highest for sites that run PHP as an Apache module (mod_php).
The release was messy. According to the PHP Foundation, the CVE numbers leaked on October 20, so the project moved the release up a day. Chainguard, which had received the fix in advance as a distributor, published patched images at 07:41 UTC on October 21, more than six hours before the coordinated release (PHP Foundation). On October 23, PHP published an extra advisory about a separate, "unlikely" attack path, CVE-2026-115560. On October 26, the US cyber agency CISA added both main flaws to its catalog of vulnerabilities that are exploited in practice (CISA).
AI played a part in the background. The PHP Foundation writes that it scanned PHP with Anthropic's Claude Mythos, through the Alpha-Omega project, and that AI-assisted research has raised the number of reports: 15 CVEs since July 1, and more than 100 reports that were invalid, duplicates or not reproducible. It does not say that the PHP2Shell reports themselves came from AI.
Why a patch will not fix Q-Day
PHP2Shell was a mistake in code. You fix the code, ship an update, and within days everyone who updates is safe. Q-Day is different. A large quantum computer running Shor's algorithm would break the math behind RSA and elliptic curves themselves. There is no bug to patch. Every system that uses that math has to switch to different algorithms: its keys, its certificates, its stored data, and every partner it talks to.
Think of a building. PHP2Shell is a faulty lock on one model of door: the locksmith swaps the lock and the building is safe again. Q-Day is the news that one type of key can be copied by anyone with a certain machine. Then you have to re-key every door, and anything locked with the old keys years ago is open too. That last part is harvest now, decrypt later: data recorded today can be read once such a machine exists.
That is why the deadlines are measured in years. NIST's final transition guidance of October 27, 2026 marks all quantum-vulnerable public-key algorithms as deprecated after 2030 and disallowed after 2035 (NIST IR 8547). Our overview of post-quantum deadlines lists who has to act when. A deadline is not a forecast: when such a computer will exist is uncertain, and the Q-Day countdown runs to the earliest named forecast, Gartner's 2029.
Where PHP stands today
Two terms first. ML-KEM is the post-quantum method NIST standardized for agreeing on a secret key; ML-DSA and SLH-DSA are post-quantum signatures. "Hybrid" means running the new method next to the old one, so an attacker has to break both.
| Layer | Status on November 3, 2026 |
|---|---|
| HTTPS | Handled by your web server and OpenSSL, not by your PHP code. OpenSSL 3.5.0 (April 8, 2025) added ML-KEM, ML-DSA and SLH-DSA, and by default offers the hybrid key exchange X25519MLKEM768 (OpenSSL release notes) |
| ext/openssl | No post-quantum functions. A PHP core contributor wrote on September 5, 2026 that "ext-openssl not only lacks PQC APIs, but also several other features" of OpenSSL 3.5 and 4 (php.internals) |
| Proposal | An open request to add post-quantum support (php-src #22862), and an RFC discussion since September 5, 2026: generic key generation, encapsulation and decapsulation for KEMs, and ML-DSA and SLH-DSA through the existing signing functions where possible (php.internals). No version or date |
| Extensions | paragonie/ext-pqcrypto, written in Rust on RustCrypto, offers ML-KEM, ML-DSA, SLH-DSA and the hybrid X-Wing (GitHub). liboqs-php wraps the Open Quantum Safe library (GitHub), whose makers write: "We do not currently recommend relying on this library in a production environment" (liboqs) |
So the transport layer is moving, through OpenSSL. The application layer, where PHP code encrypts or signs data itself, is not there yet.
What PHP developers can do now
Patch first. PHP2Shell is a real risk today; Q-Day is not. Run 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. PHP 8.2 reaches end of life on December 31, 2026 (php.net).
Check your OpenSSL version. openssl version on the server, or the OpenSSL line in php -i. With 3.5 or newer, default HTTPS connections can already use the hybrid key exchange.
Make an inventory. Search your code for openssl_ and sodium_ calls, JWT and signing libraries, and anything that stores encrypted data. Shor's algorithm targets public-key cryptography. Hashing such as password_hash and symmetric ciphers such as AES are not broken by it (see post-quantum cryptography).
Build in crypto agility. Put encryption and signing behind one interface of your own, so swapping an algorithm later is one change instead of a search through the whole codebase. The Y2Q migration guide and our guide on how to prepare for Q-Day describe the steps for an organization.
Follow the RFC. Native ML-KEM in PHP would make the application layer much easier. Until then, an extension is an option for experiments, not a reason to drop the classical method.
What we do not know
When PHP gets post-quantum functions. The RFC discussion names no version or date.
How many PHP2Shell attacks succeeded. CISA says the flaws are exploited; it gives no numbers.
When Q-Day comes. Forecasts differ and each has a name attached. The countdown page lists the sources.