Two critical PHP2Shell vulnerabilities triggered emergency security updates and temporary website shutdowns worldwide on Oct. 21, 2026. The flaws could let attackers take control of vulnerable web servers without passwords, raising concerns across businesses, government agencies, and online services.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP, a programming language widely used to build websites and applications. Both carry a critical severity rating of 9.2 under the CVSS 4.0 scoring system.
The PHP project released emergency patches Wednesday, following weeks of coordinated security work. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning, advising organizations to update their systems or take vulnerable services offline.
Although widespread successful exploitation has not been established, security researchers have documented attack attempts and some confirmed compromises. Millions of internet-facing systems may remain exposed.
What Are the PHP2Shell Vulnerabilities?
PHP2Shell refers to two flaws involving PHP’s internal memory management and error-handling processes. Under certain conditions, attackers can exploit these weaknesses to execute malicious commands on affected servers.
Researchers at Calif published a detailed technical investigation explaining how the vulnerabilities work. One involves memory corruption following out-of-memory errors. Another allows access to previously freed memory during subsequent requests.
Successful exploitation could let attackers control a vulnerable server without valid login credentials. Attackers could steal information, install malware, or maintain unauthorized access.
The PHP Foundation confirmed that the flaws affect common PHP deployment configurations, including Apache with mod_php and PHP-FPM. However, successful exploitation depends on the server’s configuration and other technical conditions.
Official fixes arrived in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP security release identifies the affected environments and explains the available updates.
Why Could PHP2Shell Affect So Much of the Internet?
PHP has powered websites for decades and remains widely used in content management systems. WordPress, Drupal, Joomla, and MediaWiki all rely on PHP.
According to W3Techs usage statistics, PHP runs on approximately 69% of websites whose server-side programming language is identifiable. That figure reflects PHP adoption, not the proportion of websites proven vulnerable.
The software also appears in business applications, internal networks and embedded systems. Its extensive use means a security problem within PHP itself can affect organizations across unrelated industries.
Some government websites, commercial services and educational platforms temporarily went offline while administrators installed updates. TechAmerica.ai previously covered the initial emergency response to the PHP vulnerabilities.
The vulnerabilities also exposed challenges facing open-source software maintainers. Many widely used projects depend on small engineering teams despite supporting critical digital infrastructure.
In 2024, a security audit organized through the Open Source Technology Improvement Fund identified multiple PHP weaknesses. The audit findings included 17 security-related issues, several of which required fixes.
The PHP Foundation later acknowledged that early signs of one PHP2Shell flaw emerged during that work. Developers struggled to devise a reliable fix without introducing compatibility problems or additional security risks.
How AI Helped Researchers Discover the PHP Bugs
Security firm Calif identified practical exploitation methods in 2026 while participating inOpenAI’ss Patch the Planet initiative. Researchers combined established security knowledge with AI-assisted code analysis and testing.
OpenAI and Wiz also identified related vulnerabilities. In its coordinated disclosure report, OpenAI described how researchers and infrastructure providers worked together to prepare defenses before public disclosure.
Calif emphasized that AI did not independently discover every weakness. Experienced researchers used their knowledge of PHP’s architecture and past vulnerabilities to investigate promising areas.
After confirming the flaws, the PHP Foundation coordinated patches with security companies and major hosting providers. Its security response statement also acknowledged delays caused by limited resources and difficult engineering decisions.
The coordinated disclosure process was complicated when information circulated before the planned release. The foundation said a distributor published patched software before the agreed deadline, potentially exposing technical details to attackers.
Hackers Attempted PHP2Shell Attacks Before Disclosure
Amazon identified suspicious exploitation attempts beginning Oct. 17, four days before the public release. Its threat intelligence investigation found activity targeting PHP2Shell through the company’s MadPot monitoring infrastructure.
Amazon could not determine how the attackers obtained information about the vulnerabilities. It also cautioned that the observed attempts did not establish whether the techniques would succeed against production systems.
Cloudflare reported a sharp increase in exploitation attempts following public disclosure. CEO Matthew Prince described the escalation in a post on X, saying attempts had risen from thousands to millions within hours.
However, security researchers cautioned against interpreting every attempt as a successful intrusion. As The Record reported, many publicly circulating exploits struggled against security protections commonly found on production servers.
Later findings indicated that some attackers had succeeded. Palo Alto Networks’ Unit 42 documented post-exploitation activity involving a European government organization. Its researchers observed unauthorized access to password hashes and secrets used for multifactor authentication.
Trail of Bits co-founder Dan Guido also reported a confirmed compromise and post-exploitation activity linked to PHP2Shell. Those reports do not establish widespread successful attacks.
Some attempted attacks involved botnet malware, including activity associated with Mirai. The Mirai botnet is known for compromising internet-connected devices and using them to launch distributed denial-of-service attacks.
What Website Owners Should Do Now
Security agencies recommend immediately identifying systems running PHP and applying the appropriate fixed releases. Updating a content management system alone will not necessarily fix vulnerabilities in the underlying PHP installation.
Administrators should also review server logs for suspicious activity dating back to at least Oct. 17. Firewalls and temporary configuration changes may reduce exposure. Still, they are not substitutes for security updates.
The situation recalls previous incidents affecting widely used technology. In 2024, a faulty CrowdStrike update caused a global Windows outage. The company later explained the software failure in its customer statement. Unlike PHP2Shell, a cyberattack did not cause disruption.
PHP2Shell also adds urgency to efforts to reduce memory-related software vulnerabilities. U.S. cybersecurity agencies have promoted memory-safe programming languages such as Rust to prevent certain classes of security defects.
Those approaches cannot immediately replace the older software supporting much of today’s internet. For PHP users, patching remains the immediate priority. Continued monitoring will also be necessary because attackers may target overlooked systems long after the initial emergency has passed.
