Two critical security vulnerabilities in PHP, a programming language used by approximately 70% of websites, prompted emergency software updates and temporary service shutdowns worldwide on October 21. The flaws, collectively known as PHP2Shell, could allow attackers to remotely access vulnerable servers without passwords, potentially exposing sensitive information or enabling unauthorized code execution.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, each received a critical severity score of 9.2 under the CVSS 4.0 framework. The PHP Foundation coordinated emergency fixes with major technology companies and hosting providers before making patches publicly available.
PHP2Shell Vulnerabilities Affect Widely Used Web Technology
Security researchers at Calif identified the vulnerabilities during an examination of PHP’s code, building on weaknesses discovered in 2024 that were previously considered difficult to exploit. The researchers worked with the PHP Foundation, OpenAI and cloud security company Wiz to verify exploitation methods and coordinate disclosure.
Both vulnerabilities involve improper memory handling that could allow attackers to execute malicious code remotely without requiring user interaction. Successful exploitation could enable data theft, malware installation and persistent unauthorized access to affected systems.
PHP supports widely used content management platforms, including WordPress, Drupal, Joomla and MediaWiki. Following the disclosure, organizations across banking, healthcare, retail, gaming and government temporarily suspended some online services while administrators installed security updates.
Attack Attempts Detected Before Public Disclosure
Despite coordinated efforts to restrict vulnerability details before the October 21 announcement, Amazon’s threat intelligence team detected attempted exploitation as early as October 17. The company could not determine how the attackers obtained information about the vulnerabilities before their public release.
Cloudflare also reported increasing attempts to exploit the flaws following disclosure. However, security researchers had not identified evidence of widespread successful compromises comparable to the largest previous internet security incidents.
Security Researchers Warn Unpatched Systems Remain Vulnerable
Emergency fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while older unsupported versions require additional attention. Security researchers continue to warn that unpatched systems remain exposed, particularly where organizations depend on older software or embedded PHP components.
Calif researchers said AI tools assisted their investigation, although identifying and exploiting the vulnerabilities still required extensive technical knowledge. The incident has also renewed attention on vulnerabilities in older software, as security teams assess how AI-assisted research may affect the discovery of previously unidentified weaknesses.
Separately, Amazon reported that patching remains the only complete fix for the two vulnerabilities, although web application firewall rules can provide additional protection. Security advisories have urged organizations to review affected installations and investigate possible exploitation attempts dating back to October 17.
Featured image credits: Magnific.com
For more stories like it, click the +Follow button at the top of this page to follow us.