Two security flaws in PHP, a programming language that powers much of the web, have sent governments and businesses racing to protect their systems. The vulnerabilities, which had gone undetected for years, could let attackers run malicious code on vulnerable servers without logging in.
The flaws, disclosed on October 21, 2026, prompted emergency software updates and temporary website shutdowns around the world. Researchers used AI to help uncover and exploit the bugs, highlighting both the security benefits and risks of increasingly capable AI tools.
The incident, known as PHP2Shell, has exposed a broader weakness in internet infrastructure: widely used software can remain vulnerable for years, while the organizations responsible for maintaining it may have limited resources.
Key Highlights
- PHP powers much of the web. Wiz estimates that about 70% of websites use the language.
- Two critical vulnerabilities were disclosed. CVE-2026-109618 and CVE-2026-109619 received severity scores of 9.2 out of 10.
- AI helped researchers uncover the flaws. The bugs affected PHP’s underlying code and had existed for years.
- Websites went offline as a precaution. Governments and businesses temporarily restricted access while installing security updates.
- Patches are available. Website owners should update PHP, contact their hosting providers and investigate possible signs of compromise.
What Is PHP?
PHP stands for PHP: Hypertext Preprocessor. It is a free, open-source programming language used to build websites and web applications.
PHP runs on servers, where it processes requests and helps generate the pages users see in their browsers. It is widely used by content management systems such as WordPress, Drupal and Joomla, as well as MediaWiki, the software behind Wikipedia.
According to cybersecurity firm Wiz, PHP powers about 70% of websites worldwide. Its long history and widespread use mean many businesses rely on it without knowing it is part of their underlying infrastructure.
PHP is maintained by an open-source community, with the PHP Foundation supporting its development and long-term maintenance.
That reach explains why a flaw in PHP itself can affect so many organizations at once.
What is PHP2Shell Vulnerability?
Researchers identified two critical vulnerabilities in PHP, officially designated CVE-2026-109618 and CVE-2026-109619.
The PHP Foundation said the flaws affect memory management and error handling, parts of the language involved in processing requests and dealing with errors.
In simple terms, software uses memory to store information while it runs. If memory is handled incorrectly, a program may leave behind unsafe references or expose data that should remain protected.
Under the right conditions, the PHP flaws can allow an attacker to execute code on an affected server remotely, without first authenticating with a username or password.
This type of attack is known as unauthenticated remote code execution, and it can give an attacker control over a vulnerable application or server.
Potential consequences include stolen data, unauthorized website changes, malware installation and continued access to a compromised system.
The vulnerabilities affect PHP itself, not just WordPress or another website platform. Updating a site’s content management system or plugins alone may therefore leave the underlying problem unresolved.
The official PHP security advisory lists the vulnerabilities and the relevant fixes.
How did AI Help Discover the Flaws?
Researchers at cybersecurity firms Calif and Wiz used advanced AI tools to help investigate PHP’s code and develop working demonstrations of the vulnerabilities.
The flaws had existed for years, but finding a software bug is not the same as proving that an attacker can exploit it. Researchers must understand how the code behaves, identify a viable attack path and test whether the technique works.
AI helped accelerate that process.
The work was connected to security research initiatives involving OpenAI and Wiz. Researchers still contributed the technical knowledge, testing and verification needed to establish the flaws’ impact.
The incident demonstrates how AI can help defenders identify weaknesses in widely used software. It also highlights a risk: attackers may use similar tools to understand newly disclosed flaws and develop exploits more quickly.
As Ryan Ko of the University of Queensland’s Cyber Research Centre has observed, many software vulnerabilities stem from systems built with functionality in mind before security received the same attention.
The PHP incident shows why reviewing older code remains essential, even when software has been used successfully for decades.
Why did Websites around the World Go Offline?
The PHP Foundation released security patches on October 21, 2026, after details of the vulnerabilities began circulating online ahead of the planned disclosure.
The early disclosure compressed the time available for organizations to prepare. Governments and businesses moved quickly to identify affected systems, apply updates and restrict access where immediate patching was not possible.
Reported disruptions affected websites and services in several countries, including Canada, France, Finland, Japan and the Netherlands. Wikimedia also took some systems offline as a precaution.
These shutdowns did not necessarily indicate successful attacks. In many cases, administrators temporarily disabled services to reduce exposure while installing fixes.
The scale of the response reflected the difficulty of identifying every vulnerable system. PHP can run on public websites, internal applications and management interfaces, including systems that organizations may not immediately associate with web development.
Attack attempts also increased sharply following disclosure. Cloudflare chief executive Matthew Prince reported thousands of attempts before public disclosure, followed by tens of thousands within 45 minutes, hundreds of thousands within two hours and millions afterward.
Those figures describe attempted exploitation, not confirmed successful attacks.
Amazon also reported suspicious activity against a honeypot, a decoy system used to detect malicious behavior, before the public release of the patches. The company said it could not determine how the actor had obtained information about the vulnerabilities.
The available evidence must be distinguished carefully: attempts to exploit a flaw do not necessarily mean an attacker gained access. Still, the activity reinforces the need to patch quickly and investigate systems that may have been exposed.
Have Hackers Exploited PHP2Shell?
Security firms have reported attempts to exploit PHP2Shell, but those attempts should not be treated as proof of widespread compromise.
The PHP Foundation said it had no evidence that the two original vulnerabilities had been successfully exploited before disclosure. Other reporting has documented scanning and attempts to use exploit code, while some security reports have described suspicious post-exploitation activity.
The full extent of any successful intrusions remains uncertain. Organizations may also take time to detect an attack that occurred before a patch was installed.
The practical lesson is that patching and incident investigation are separate tasks. Updating PHP closes the known vulnerabilities in the fixed version, but it cannot reverse an intrusion that has already occurred.
How is PHP2Shell Being Fixed?
The PHP team released patched versions on October 21. The relevant fixed releases listed in the security advisory are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Administrators should check the official PHP security advisory and PHP downloads page for current release information.
Organizations running older PHP versions should consult their software or operating-system vendor. Some providers issue their own security fixes, while unsupported installations may require an upgrade.
The PHP Foundation recommends updating immediately. If an affected system cannot be patched or protected promptly, security agencies advise restricting access or taking it offline until it can be secured.
A patch also does not eliminate the need to review server logs and check for signs of earlier unauthorized access.
What Should Website Owners Do?
Website owners and administrators should confirm that their systems are protected, even if their sites appear to be working normally.
1. Contact your web hosting provider: If a hosting company or web developer manages your website, ask whether the PHP2Shell security patches have been applied. Confirm that the server runs a fixed, supported PHP version and ask whether further action is required.
Do not assume that updating WordPress, its themes or its plugins fixes PHP itself. The underlying PHP runtime may require a separate update.
2. Check your PHP version: If you manage your own server, identify the installed version and compare it with the official PHP security advisory. Install the appropriate fixed release.
3. Check every system that uses PHP: Review public websites, internal applications, administrative interfaces and other systems that may rely on PHP. Updating the main website may not address every vulnerable installation.
4. Take vulnerable services offline if necessary: If you cannot install the fix promptly, consider temporarily disabling public access. The US National Security Agency has advised organizations unable to patch immediately to take affected systems offline.
5. Look for signs of compromise: After patching, check logs for unusual activity, unfamiliar processes, unauthorized file changes or unexpected command execution. If you suspect an intrusion, seek help from a qualified security professional.
6. Continue monitoring security updates: Follow guidance from the PHP Foundation, your hosting provider and the developers of any affected software.
Most ordinary internet users do not need to change anything on their own devices. They should follow security notices from services they use and remain alert to phishing messages that exploit news of the vulnerability.
What does this mean for the Future of Internet Security?
PHP2Shell highlights a long-standing problem: modern internet services rely on software that may be decades old and maintained by relatively small teams.
Open-source software is free to use, but maintaining it requires funding, security reviews, testing and developers who can respond when problems emerge. The number of organizations that depend on a project can far exceed the resources available to its maintainers.
AI adds another dimension. It can help researchers find vulnerabilities that might otherwise remain hidden for years, but it may also shorten the time attackers need to develop working exploits.
That creates pressure on software developers, hosting companies and businesses to improve how they track dependencies, distribute updates and respond to security alerts.
Some developers are also moving toward memory-safe programming languages, such as Rust, that prevent many common memory-management errors. However, replacing established systems takes time, and no language eliminates every security risk.
For now, the priority is straightforward: identify vulnerable PHP installations, apply the available fixes and investigate possible earlier intrusions.
PHP2Shell has not demonstrated that the entire internet was successfully compromised. It has shown how a weakness in a widely used component can disrupt services around the world, and how quickly the race between finding vulnerabilities and fixing them can unfold.
The next test is whether organizations can secure the systems that remain exposed long after the initial headlines fade.