Critical PHP Vulnerabilities Led to Widespread Exploitation Attempts Before Patch Release

Two critical remote code execution vulnerabilities, collectively known as PHP2Shell, were patched on October 21, 2026, after details leaked online and exploitation attempts began four days prior[8][14]. These flaws affected approximately 70% of websites globally, allowing unauthenticated attackers to execute arbitrary code on servers[2][3][15].

The widespread use of PHP in popular content management systems like WordPress, Drupal, and Joomla meant that these vulnerabilities posed a significant risk to a vast portion of the internet's infrastructure[5][16]. The rapid public disclosure and subsequent exploitation created an urgent situation for website administrators worldwide, highlighting the fragile security of foundational web technologies[3][4].

What the records show

The two critical memory-corruption RCE vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619[7]. Both were assigned a critical CVSS 4.0 score of 9.2[7]. CVE-2026-109618 stems from out-of-memory errors where PHP’s longjmp() function leaves request memory uninitialized, allowing RCE[10][12]. CVE-2026-109619 relates to PHP's global state potentially referencing freed memory regions following abnormal request termination[10][12]. These memory safety flaws are reported to have existed in the PHP codebase for over a decade, with all PHP versions from 5.4 through 8.5.11 identified as vulnerable, including older unsupported branches like PHP 5[8][11][15]. Cybersecurity firm Calif, along with OpenAI, contributed to the discovery efforts using a frontier model from OpenAI[3][8]. Initial signs of these vulnerabilities were noted by researchers during a security audit in 2024, but their exploitability could not be proven at that time[5].

The timeline

Amazon Threat Intelligence detected the first exploitation attempt for PHP2Shell on October 17, 2026, four days before the public disclosure[14][15]. This attempt originated from an anonymized IP address targeting a honeypot, suggesting the activity was carried out by a threat actor[14][15]. On October 20, 2026, details of the vulnerabilities leaked online, appearing on social media and online forums[8][17]. This leak prompted the PHP security team to accelerate their patch release schedule, bringing it forward by a day[2][8]. Following the leak and before the official patch, proof-of-concept exploits began to circulate, leading to an increase in exploitation attempts[14][16]. Official patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released on October 21, 2026, at 14:00 UTC[8][9][11].

What changed and for whom

The incident led to extensive impact across the internet due to PHP’s widespread adoption by approximately 70% of websites globally[2][3][5][15]. Popular content management systems such as WordPress, Drupal, and Joomla were specifically identified as being affected[16]. As a precautionary measure, government websites in Germany and Finland, among other European countries, were temporarily taken offline[4]. Sites like 4chan reportedly experienced outages[4]. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a strong advisory urging immediate patching for CVE-2026-109618 and CVE-2026-109619 to the latest patched versions[6]. The PHP project is not releasing fixes for PHP 8.1 or earlier versions, as they have reached end-of-life status, requiring users of these older versions to migrate to a supported branch[11][13]. Volunteer maintainer Ondřej Surý, who helps automate patches for PHP, played a key role in the rapid response efforts, building update packages used by administrators worldwide[1][2][5].

What the subject has said publicly

Cloudflare CEO Matthew Prince stated that in the 10 hours before the flaws were publicly announced, Cloudflare observed thousands of exploitation attempts[3]. He added that these attempts jumped to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions afterward[3]. CISA strongly urged organizations to immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities[6]. Amazon reported that the initial exploitation attempt from an anonymized IP address before disclosure suggests threat actor activity[14][15].

What we could not confirm

It remains unclear how the actor who made the initial exploitation attempt on October 17, 2026, acquired exploit information prior to the public disclosure[14][15].