# Critical PHP Flaws Exposed as 'PHP2Shell' Threatens Global Websites

> Two critical memory safety vulnerabilities in the PHP programming language, dubbed 'PHP2Shell,' were disclosed on October 21, 2026, exposing an estimated 70% of websites to unauthenticated remote code execution.

By PrimaryBrief newsroom · Published 2026-10-25T14:19:09.826652Z
Canonical: https://primarybrief.com/article/critical-php-flaws-exposed-as-php2shell-threatens-global-websites-b3a3d20c

The PHP Foundation disclosed two critical memory safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026, which allow unauthenticated remote code execution and received a critical CVSS v4.0 score of 9.2 [1][2][7][11]. These flaws, dubbed "PHP2Shell," affect an estimated 70% of websites worldwide, with exploitation attempts documented days before official patches were released [1][4][13][25][26].

The widespread use of PHP means millions of websites, from personal blogs to major e-commerce platforms, faced immediate risk of server compromise by attackers [1][4][11]. The rapid discovery, leak, and exploitation of these flaws show the intense challenge in securing fundamental internet infrastructure against escalating cyber threats [13][14][15][25][26].

## The PHP2Shell Vulnerabilities

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are memory safety issues found within the core of the PHP programming language itself [2][9][11][12]. They stem from how PHP manages requests that encounter failures, particularly in cases of out-of-memory conditions or stale global states [9][10][12]. An attacker could use these flaws to run code with the privileges of the compromised PHP process without needing any prior authentication [2][9][11]. Reports indicate these issues have existed for more than a decade, with their root causes identified as early as 2004, but the PHP security team had not reached a consensus on a permanent fix [5][18]. The vulnerabilities impact PHP installations that process web requests, including common setups like PHP-FPM and Apache deployments using mod_php [2].

## Rapid Disclosure and Exploitation

The PHP Foundation publicly announced the existence of the vulnerabilities on October 20, 2026, with patches scheduled for release the following day at 14:00 UTC [8][14][15]. However, information about the vulnerabilities, including their CVE identifiers, was leaked prematurely before the scheduled disclosure [14][15]. Evidence indicates exploitation attempts began as early as October 17, 2026, four days before the official patches became available [13][25][26]. Amazon Web Services (AWS) recorded an exploit attempt on October 17 and observed new exploits targeting its sensors almost immediately after the 14:00 UTC patch release on October 21 [13][25]. Cloudflare also reported early attacks at 07:43 UTC on October 21, several hours before the patches were made public [27].

## AI's Role in Discovery

Artificial intelligence played a significant part in the discovery of these flaws by several independent teams [16]. Security firm Wiz Research identified the first vulnerability in August 2026, utilizing its AI tool Atlas, which integrates Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol [16][17][18][19][24]. By late August 2026, Wiz Research confirmed unauthenticated remote code execution against both Drupal and WordPress sites [16][24]. Wiz reported the vulnerabilities to the PHP security team on August 24, 2026, initiating the coordinated disclosure process [24]. OpenAI also stated that security firm Calif identified one of the critical flaws using its GPT-5.6 Sol model as part of a security program called "Patch the Planet" [20][21][22][23].

## Volunteer Efforts for Rapid Patching

During the urgent effort to patch these vulnerabilities, Ondrej Sury, a volunteer in Czechia, made crucial contributions to making fixes available [3]. Sury has spent more than 20 years packaging PHP in his spare time [3]. Within hours of PHP's emergency release, his builds enabled Debian and Ubuntu servers worldwide to install the patch with a single command, even for PHP versions that no longer receive official updates [3][6]. As of October 23, 2026, Sury's repositories carried fixed PHP2Shell builds for multiple PHP versions, including backported builds for PHP 5.6 through 8.1 [6].

## What the PHP Foundation Said

The PHP Foundation referred to the long-standing unpatched vulnerability as a "structural failure" due to its security team's inability to reach a consensus on a solution for many months [5]. The Foundation urged immediate action from anyone operating PHP-based websites and initiated an urgent, global effort to distribute patches [1].

## What We Could Not Confirm

The specific source of the leaked vulnerability details on October 20, 2026, which occurred before the planned public disclosure, could not be confirmed [14][15]. The full extent of successful exploitation of PHP2Shell vulnerabilities across all affected websites globally remains unconfirmed [27].

## Evidence cited
1. shattered.io (shattered.io) — https://shattered.io/
2. arcticwolf.com (Arctic Wolf) — https://arcticwolf.com/
3. bytemuni.com (bytemuni.com) — https://bytemuni.com/
4. herodevs.com (herodevs.com) — https://herodevs.com/
5. bluewin.ch (bluewin.ch) — https://bluewin.ch/
6. eseospace.com (eseospace.com) — https://eseospace.com/
7. ddev.com (ddev.com) — https://ddev.com/
8. wikipedia.org (Wikipedia) — https://wikipedia.org/
9. fortinet.com (Fortinet) — https://fortinet.com/
10. dynatrace.com (Dynatrace) — https://dynatrace.com/
11. php2shell.com (php2shell.com) — https://php2shell.com/
12. aikido.dev (aikido.dev) — https://aikido.dev/
13. datadoghq.com (Datadog) — https://datadoghq.com/
14. akamai.com (Akamai) — https://akamai.com/
15. watchtowr.com (WatchTowr) — https://watchtowr.com/
16. trendingtopics.eu (Trending Topics) — https://trendingtopics.eu/
17. reddit.com (Reddit) — https://reddit.com/
18. tidbits.com (TidBITS) — https://tidbits.com/
19. google.com (Google Cloud) — https://google.com/
20. thenextweb.com (The Next Web) — https://thenextweb.com/
21. mashable.com (Mashable) — https://mashable.com/
22. gizmodo.com (Gizmodo) — https://gizmodo.com/
23. the-decoder.com (The Decoder) — https://the-decoder.com/
24. recordedfuture.com (Recorded Future) — https://recordedfuture.com/
25. brandefense.io (Brandefense) — https://brandefense.io/
26. socradar.io (SOCRadar) — https://socradar.io/
27. sansec.io (Sansec) — https://sansec.io/