Two critical security vulnerabilities in PHP, a programming language used by websites worldwide, could allow hackers to remotely take control of vulnerable servers without logging in, prompting emergency software updates and a global response from cybersecurity teams.

The PHP development team released security patches on October 21 for two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell. Both received a severity rating of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS) version 4.0. Successful exploitation could allow attackers to execute malicious code on affected servers and potentially access sensitive information stored in their memory.

The vulnerabilities affect PHP’s underlying engine rather than individual websites or plugins. This means that updating a website’s content management system, themes or plugins alone will not resolve the issue if the server continues to run a vulnerable PHP version.

PHP is widely used to power websites and platforms, including WordPress, Drupal and Joomla. According to cybersecurity firm Wiz Research, the language supports approximately 70% of websites worldwide, underscoring the potential reach of vulnerabilities in its core infrastructure. That figure represents PHP’s estimated prevalence, however, not the proportion of websites confirmed vulnerable or compromised.

What Is PHP2Shell?

PHP2Shell refers to two vulnerabilities in PHP’s core engine that can enable remote code execution, a type of security flaw that allows an attacker to run commands or code on a target system from another location.

The first vulnerability, CVE-2026-109618, involves memory corruption associated with an out-of-memory condition. The second, CVE-2026-109619, involves stale internal state that can persist after memory has been released, potentially allowing subsequent requests to misuse that memory.

In simpler terms, PHP can mishandle internal data under certain conditions when processing web requests. Attackers can send specially crafted requests to trigger these weaknesses and potentially execute code on the affected server.

The absence of an authentication requirement makes the vulnerabilities particularly concerning. Attackers do not necessarily need a legitimate account or a stolen password to attempt exploitation against an exposed, vulnerable server.

If successful, an attack could enable unauthorized access to server resources, website tampering, data theft or further malicious activity. Sensitive information held in the PHP process’s memory, including credentials, authentication tokens and API keys, may also be exposed.

However, the vulnerabilities do not mean that every website running PHP has been hacked. Actual exposure depends on factors including the installed PHP version, server configuration and whether an attacker successfully exploits the system.

Why Websites Are at Risk Even When Their Applications Are Updated

PHP2Shell presents a particular challenge because the flaws exist beneath the applications that use the programming language.

Many website administrators regularly update their content management systems and plugins to address known security weaknesses. While those updates remain important, they cannot independently repair a vulnerability in the PHP runtime itself.

The PHP development team warned that installations processing web requests may be affected across several deployment configurations, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed. The team identified Apache mod_php as presenting the highest demonstrated risk, with an exploit capable of triggering before application code runs.

This means an organization could have an updated WordPress website and still face exposure through its underlying server software.

The implications extend to online shops, publishing platforms, business websites and public-sector services that rely on vulnerable PHP installations. Organizations running multiple websites may also need to investigate shared hosting environments and other systems that use the same affected runtime.

For website operators, the critical task is identifying and updating the actual PHP installation—not simply checking whether the website itself is running the latest version.

Emergency Patches Released as Attack Attempts Emerge

The PHP project released fixes on October 21, bringing forward the planned disclosure schedule after information about the vulnerabilities surfaced publicly.

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations using affected installations are strongly advised to update immediately. Older versions may require security updates from their operating-system distributors or hosting providers, or migration to a supported release.

Cybersecurity providers have also reported attack traffic targeting PHP2Shell.

Cloudflare said it deployed web application firewall protections before public disclosure and enabled default protection for customers using its free and paid WAF offerings. Security researchers have also reported exploitation attempts around the release of the patches.

These reports demonstrate that attackers are attempting to exploit the vulnerabilities. They do not establish that every targeted server has been compromised or that widespread successful intrusions have occurred.

The distinction is important because security teams must respond to active threats before successful attacks are confirmed. Once technical details and proof-of-concept exploits become available, malicious actors may have more opportunities to develop and adapt their own attack methods.

The PHP project has warned that temporary configuration changes can reduce exposure to specific attack paths but do not make a vulnerable installation safe. Installing the appropriate security update remains the only complete remediation.

Some Governments Took Websites Offline

PHP2Shell has triggered precautionary shutdowns and service disruptions across multiple countries as governments and organizations moved to contain the risks posed by the vulnerabilities.

In Finland, state IT provider Valtori temporarily took public-facing government services offline while security updates were prepared and applied. The Netherlands saw broader disruption, affecting services that included its National Cyber Security Centre website, citizen portals and parliamentary websites. Germany, France and Belgium also reported precautionary measures involving government and other public-facing services.

In Japan, Prime Minister Sanae Takaichi urged operators of public websites to check whether they used PHP, apply the necessary patches and consider temporary shutdowns if they could not secure their systems promptly. Meanwhile, US cybersecurity agencies, including the NSA, FBI and CISA, issued urgent guidance calling for immediate patching or taking affected systems offline when updates could not be applied quickly.

The PHP project’s official assessment assigns both CVE-2026-109618 and CVE-2026-109619 a CVSS 4.0 score of 9.2 out of 10, classified as critical. Some independent security researchers, including watchTowr, have assigned a maximum score of 10.0, while other assessments have cited scores around 9.8 under the older CVSS 3.1 framework. These scores reflect different assessments and scoring frameworks; the PHP project’s 9.2 rating remains its official score.

AI-Assisted Research Helped Uncover the Vulnerabilities

PHP2Shell has also drawn attention to the growing role of artificial intelligence in cybersecurity research.

Wiz Research reported that advanced AI models helped researchers analyze PHP’s code and develop working exploits for the vulnerabilities. The research involved collaboration among Wiz, Calif, OpenAI and other participants.

The significance lies in the complexity of the underlying defects. Memory-management vulnerabilities can be difficult to identify and turn into reliable exploits because their behavior depends on how software allocates, releases and reuses memory under specific conditions.

AI-assisted analysis can help researchers investigate these interactions and test whether a suspected weakness can be exploited in practice.

The same capabilities may also lower the effort required for malicious actors to investigate vulnerabilities and adapt existing exploits. But AI’s role in discovering or validating PHP2Shell does not mean that an AI system independently compromised websites.

Instead, the incident highlights the importance of quickly translating vulnerability research into security fixes and ensuring those fixes reach the systems that need them.

What Website Owners Should Do Now

Organizations operating PHP-based websites should prioritize identifying vulnerable installations and applying the appropriate security updates.

The PHP project recommends updating to a fixed version, while cybersecurity authorities advise organizations to assess internet-facing systems and monitor for signs of compromise.

Immediate actions include:

• Update PHP: Install a fixed release or apply a security update provided by the relevant operating-system distributor or hosting provider.
• Check hosting environments: Website owners who do not manage their own servers should confirm that their provider has updated the underlying PHP runtime.
• Review exposed systems: Identify production servers, containers and other internet-facing services that may contain vulnerable PHP installations.
• Maintain protective controls: Keep available firewall protections enabled while remediation is underway, without treating them as a substitute for patching.
• Investigate suspicious activity: Review relevant logs and monitoring data for unexpected processes, unusual requests or other indicators of compromise.
• Assess exposed credentials: If an investigation indicates that sensitive information may have been exposed, determine which credentials and secrets could be affected and rotate them as appropriate.

For unsupported PHP versions, administrators should consult their vendor’s security guidance and consider migrating to a supported branch. PHP has noted that some distributors provide backported fixes for older versions, so administrators should verify the status of their specific packages rather than relying on version numbers alone.

Ordinary website visitors generally do not need to install a PHP2Shell patch on their personal devices. The immediate remediation responsibility lies with the organizations and service providers operating the affected servers.

Nevertheless, the vulnerability highlights why the security of online services depends on more than the applications users can see. A website may appear fully functional while relying on underlying software that requires urgent attention.

‍

‍