137
Two critical security vulnerabilities in PHP, a programming language widely used to build websites, have triggered an urgent security response after researchers demonstrated that attackers could execute code on vulnerable servers without authentication.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026, under the name PHP2Shell.
The flaws affect PHP’s core runtime and could also expose sensitive information stored in process memory. Both have received a critical severity score of 9.2 on the Common Vulnerability Scoring System (CVSS).
The discovery has raised concerns because PHP supports widely used platforms such as WordPress, Drupal and Joomla. Security firm Wiz estimates that PHP powers around 70% of websites worldwide. However, this does not mean that 70% of websites are vulnerable to these specific flaws.
According to Wiz Research, AI-assisted analysis helped researchers identify weaknesses that had remained in PHP’s codebase for years. The research involved Wiz Atlas, Google’s Gemini 4 Argon and OpenAI’s GPT- 5.6 Sol. Wiz said Gemini 4 Argon played a significant role in discovering the vulnerabilities and developing exploits. Researchers also worked with the PHP security team and industry partners to coordinate disclosure and prepare fixes.
Cloudflare said it deployed web application firewall protections before the public disclosure and observed attack traffic. This highlights the need for website administrators to act quickly. However, the presence of attack traffic does not necessarily mean that vulnerable servers were successfully compromised.
The Canadian Centre for Cyber Security said in its October 21 assessment that it had not identified active exploitation at that time. It also warned that the situation could change rapidly.
The PHP project has released security fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Administrators should upgrade to the appropriate patched version as soon as possible, prioritising internet-facing servers and applications. PHP 8.1 and older versions no longer receive direct updates from the PHP project, although some vendors may provide security fixes separately.
Updating a WordPress plugin, theme or other website application alone will not resolve the issue because the vulnerabilities affect PHP itself. Website owners using managed hosting services should contact their providers to confirm that the underlying PHP runtime has been updated.
Organisations that cannot apply the fixes immediately should assess whether affected systems need to be isolated from the internet until they can be secured. Security teams should also examine server and application logs for suspicious activity, unexpected processes, unfamiliar files and unusual outbound connections.
The PHP2Shell vulnerabilities highlight the potential of AI-assisted research to uncover long-standing software weaknesses. They also underline the importance of timely security updates and coordinated action by software developers, hosting providers and website administrators.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026, under the name PHP2Shell.
The flaws affect PHP’s core runtime and could also expose sensitive information stored in process memory. Both have received a critical severity score of 9.2 on the Common Vulnerability Scoring System (CVSS).
The discovery has raised concerns because PHP supports widely used platforms such as WordPress, Drupal and Joomla. Security firm Wiz estimates that PHP powers around 70% of websites worldwide. However, this does not mean that 70% of websites are vulnerable to these specific flaws.
According to Wiz Research, AI-assisted analysis helped researchers identify weaknesses that had remained in PHP’s codebase for years. The research involved Wiz Atlas, Google’s Gemini 4 Argon and OpenAI’s GPT- 5.6 Sol. Wiz said Gemini 4 Argon played a significant role in discovering the vulnerabilities and developing exploits. Researchers also worked with the PHP security team and industry partners to coordinate disclosure and prepare fixes.
Cloudflare said it deployed web application firewall protections before the public disclosure and observed attack traffic. This highlights the need for website administrators to act quickly. However, the presence of attack traffic does not necessarily mean that vulnerable servers were successfully compromised.
The Canadian Centre for Cyber Security said in its October 21 assessment that it had not identified active exploitation at that time. It also warned that the situation could change rapidly.
The PHP project has released security fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Administrators should upgrade to the appropriate patched version as soon as possible, prioritising internet-facing servers and applications. PHP 8.1 and older versions no longer receive direct updates from the PHP project, although some vendors may provide security fixes separately.
Updating a WordPress plugin, theme or other website application alone will not resolve the issue because the vulnerabilities affect PHP itself. Website owners using managed hosting services should contact their providers to confirm that the underlying PHP runtime has been updated.
Organisations that cannot apply the fixes immediately should assess whether affected systems need to be isolated from the internet until they can be secured. Security teams should also examine server and application logs for suspicious activity, unexpected processes, unfamiliar files and unusual outbound connections.
The PHP2Shell vulnerabilities highlight the potential of AI-assisted research to uncover long-standing software weaknesses. They also underline the importance of timely security updates and coordinated action by software developers, hosting providers and website administrators.
