Critical PHP Flaws Exposed as 'PHP2Shell' Threatens Global Websites

The PHP Foundation disclosed two critical memory safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026, which allow unauthenticated remote code execution and received a critical CVSS v4.0 score of 9.2[1][2][7][11]. These flaws, dubbed "PHP2Shell," affect an estimated 70% of websites worldwide, with exploitation attempts documented days before official patches were released[1][4][13][25][26].

The widespread use of PHP means millions of websites, from personal blogs to major e-commerce platforms, faced immediate risk of server compromise by attackers[1][4][11]. The rapid discovery, leak, and exploitation of these flaws show the intense challenge in securing fundamental internet infrastructure against escalating cyber threats[13][14][15][25][26].

The PHP2Shell Vulnerabilities

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are memory safety issues found within the core of the PHP programming language itself[2][9][11][12]. They stem from how PHP manages requests that encounter failures, particularly in cases of out-of-memory conditions or stale global states[9][10][12]. An attacker could use these flaws to run code with the privileges of the compromised PHP process without needing any prior authentication[2][9][11]. Reports indicate these issues have existed for more than a decade, with their root causes identified as early as 2004, but the PHP security team had not reached a consensus on a permanent fix[5][18]. The vulnerabilities impact PHP installations that process web requests, including common setups like PHP-FPM and Apache deployments using mod_php[2].

Rapid Disclosure and Exploitation

The PHP Foundation publicly announced the existence of the vulnerabilities on October 20, 2026, with patches scheduled for release the following day at 14:00 UTC[8][14][15]. However, information about the vulnerabilities, including their CVE identifiers, was leaked prematurely before the scheduled disclosure[14][15]. Evidence indicates exploitation attempts began as early as October 17, 2026, four days before the official patches became available[13][25][26]. Amazon Web Services (AWS) recorded an exploit attempt on October 17 and observed new exploits targeting its sensors almost immediately after the 14:00 UTC patch release on October 21[13][25]. Cloudflare also reported early attacks at 07:43 UTC on October 21, several hours before the patches were made public[27].

AI's Role in Discovery

Artificial intelligence played a significant part in the discovery of these flaws by several independent teams[16]. Security firm Wiz Research identified the first vulnerability in August 2026, utilizing its AI tool Atlas, which integrates Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol[16][17][18][19][24]. By late August 2026, Wiz Research confirmed unauthenticated remote code execution against both Drupal and WordPress sites[16][24]. Wiz reported the vulnerabilities to the PHP security team on August 24, 2026, initiating the coordinated disclosure process[24]. OpenAI also stated that security firm Calif identified one of the critical flaws using its GPT-5.6 Sol model as part of a security program called "Patch the Planet"[20][21][22][23].

Volunteer Efforts for Rapid Patching

During the urgent effort to patch these vulnerabilities, Ondrej Sury, a volunteer in Czechia, made crucial contributions to making fixes available[3]. Sury has spent more than 20 years packaging PHP in his spare time[3]. Within hours of PHP's emergency release, his builds enabled Debian and Ubuntu servers worldwide to install the patch with a single command, even for PHP versions that no longer receive official updates[3][6]. As of October 23, 2026, Sury's repositories carried fixed PHP2Shell builds for multiple PHP versions, including backported builds for PHP 5.6 through 8.1[6].

What the PHP Foundation Said

The PHP Foundation referred to the long-standing unpatched vulnerability as a "structural failure" due to its security team's inability to reach a consensus on a solution for many months[5]. The Foundation urged immediate action from anyone operating PHP-based websites and initiated an urgent, global effort to distribute patches[1].

What We Could Not Confirm

The specific source of the leaked vulnerability details on October 20, 2026, which occurred before the planned public disclosure, could not be confirmed[14][15]. The full extent of successful exploitation of PHP2Shell vulnerabilities across all affected websites globally remains unconfirmed[27].