Critical PHP2Shell Flaws Put Millions of Sites at Risk
Emergency PHP patches fix two critical PHP2Shell flaws allowing remote code execution with no login. Governments took websites offline as admins raced to patch.
The web had an emergency on Wednesday. PHP, the programming language that quietly powers most of the internet, released emergency security patches for two critical vulnerabilities that let an attacker run code on a server without any login. Governments, broadcasters and companies around the world took websites offline rather than risk being attacked while they patched. The flaws, now called PHP2Shell, went unnoticed for more than a decade - and artificial intelligence is what finally found them.
What PHP2Shell is
PHP2Shell is the name given to two flaws in the PHP language itself: CVE-2026-109618 and CVE-2026-109619. Both are rated critical, 9.2 out of 10 on the CVSS severity scale. Because the bugs sit inside the PHP interpreter rather than in any one app, every site running a vulnerable PHP version is exposed - even when the site's own code is perfectly secure. The flaws affect versions as early as PHP 5.4, and the risk is highest for servers using Apache's mod_php, where an attack can trigger before the site's own code even runs.
How dangerous is it
The worst of the two flaws allows unauthenticated remote code execution: an attacker with no account can get a shell on the server, reaching the file system and the database. Researchers at Wiz demonstrated the attack against the latest WordPress, Drupal and Joomla images, and found it could also read server memory - which may contain passwords, tokens and API keys - without running any code. With PHP behind an estimated 70 percent of the world's websites, the blast radius is enormous. The UK's National Cyber Security Centre told organisations that could not patch immediately to take their systems offline.
Found by AI, disclosed under pressure
The flaws were independently discovered by security firms Wiz and Calif, with help from AI models - Wiz and Calif used OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon to locate and verify the bugs as part of OpenAI's "Patch the Planet" project. Details leaked online on October 20, a day before the planned disclosure, which forced the PHP team to publish emergency fixes around 14:00 UTC on October 21 - in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Patch versions cover only PHP 8.2 and newer, leaving older sites exposed with no fix in sight.
Sites went dark worldwide
As patches landed, admins raced to take precautions. In the Netherlands, DigiD, MijnOverheid, the Dutch House of Representatives' website, Tweakers and even the national cyber security centre's own site went offline. Japanese services including Kodmon and Sakura Rental Server announced emergency maintenance believed to be linked to the flaw. And the first attack attempts were already being observed: Cloudflare said it saw attack traffic targeting its customers shortly after disclosure.
What to do now
If you run a website on PHP, update to the fixed release for your version line right now and restart your web server and PHP workers - updating is the only safe choice, according to the PHP team. If patching is not immediately possible, follow the UK NCSC's advice and consider taking the site offline until it can be protected.
Sources
- NZ Herald (AFP) - https://www.nzherald.co.nz/business/websites-go-dark-worldwide-as-ai-exposes-critical-security-flaws/BND2QLDHG5F2LHAAXEKC24CIKI/ - Computer Weekly - https://www.computerweekly.com/news/366652446/Critical-PHP-flaws-puts-millions-of-websites-at-risk-of-takeover - The Hacker News - http://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html - Patchstack - https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/