# Critical PHP Vulnerabilities Led to Widespread Exploitation Attempts Before Patch Release

> Two critical remote code execution vulnerabilities in PHP, dubbed PHP2Shell, were patched on October 21, 2026, after details leaked online and exploitation attempts began four days prior, affecting approximately 70% of websites globally.

By PrimaryBrief newsroom · Published 2026-10-26T01:07:42.117651Z
Canonical: https://primarybrief.com/article/critical-php-vulnerabilities-led-to-widespread-exploitation-attempts-before-patch-release-d57540c9

Two critical remote code execution vulnerabilities, collectively known as PHP2Shell, were patched on October 21, 2026, after details leaked online and exploitation attempts began four days prior [8][14]. These flaws affected approximately 70% of websites globally, allowing unauthenticated attackers to execute arbitrary code on servers [2][3][15].

The widespread use of PHP in popular content management systems like WordPress, Drupal, and Joomla meant that these vulnerabilities posed a significant risk to a vast portion of the internet's infrastructure [5][16]. The rapid public disclosure and subsequent exploitation created an urgent situation for website administrators worldwide, highlighting the fragile security of foundational web technologies [3][4].

## What the records show

The two critical memory-corruption RCE vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 [7]. Both were assigned a critical CVSS 4.0 score of 9.2 [7]. CVE-2026-109618 stems from out-of-memory errors where PHP’s `longjmp()` function leaves request memory uninitialized, allowing RCE [10][12]. CVE-2026-109619 relates to PHP's global state potentially referencing freed memory regions following abnormal request termination [10][12]. These memory safety flaws are reported to have existed in the PHP codebase for over a decade, with all PHP versions from 5.4 through 8.5.11 identified as vulnerable, including older unsupported branches like PHP 5 [8][11][15]. Cybersecurity firm Calif, along with OpenAI, contributed to the discovery efforts using a frontier model from OpenAI [3][8]. Initial signs of these vulnerabilities were noted by researchers during a security audit in 2024, but their exploitability could not be proven at that time [5].

## The timeline

Amazon Threat Intelligence detected the first exploitation attempt for PHP2Shell on October 17, 2026, four days before the public disclosure [14][15]. This attempt originated from an anonymized IP address targeting a honeypot, suggesting the activity was carried out by a threat actor [14][15]. On October 20, 2026, details of the vulnerabilities leaked online, appearing on social media and online forums [8][17]. This leak prompted the PHP security team to accelerate their patch release schedule, bringing it forward by a day [2][8]. Following the leak and before the official patch, proof-of-concept exploits began to circulate, leading to an increase in exploitation attempts [14][16]. Official patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released on October 21, 2026, at 14:00 UTC [8][9][11].

## What changed and for whom

The incident led to extensive impact across the internet due to PHP’s widespread adoption by approximately 70% of websites globally [2][3][5][15]. Popular content management systems such as WordPress, Drupal, and Joomla were specifically identified as being affected [16]. As a precautionary measure, government websites in Germany and Finland, among other European countries, were temporarily taken offline [4]. Sites like 4chan reportedly experienced outages [4]. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a strong advisory urging immediate patching for CVE-2026-109618 and CVE-2026-109619 to the latest patched versions [6]. The PHP project is not releasing fixes for PHP 8.1 or earlier versions, as they have reached end-of-life status, requiring users of these older versions to migrate to a supported branch [11][13]. Volunteer maintainer Ondřej Surý, who helps automate patches for PHP, played a key role in the rapid response efforts, building update packages used by administrators worldwide [1][2][5].

## What the subject has said publicly

Cloudflare CEO Matthew Prince stated that in the 10 hours before the flaws were publicly announced, Cloudflare observed thousands of exploitation attempts [3]. He added that these attempts jumped to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions afterward [3]. CISA strongly urged organizations to immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities [6]. Amazon reported that the initial exploitation attempt from an anonymized IP address before disclosure suggests threat actor activity [14][15].

## What we could not confirm

It remains unclear how the actor who made the initial exploitation attempt on October 17, 2026, acquired exploit information prior to the public disclosure [14][15].

## Evidence cited
1. Cybersecurity Experts Are Bracing for a ‘Vulnerability Tsunami’—and They’re Using AI to Find It (reason.com) — https://reason.com/2026/10/23/cybersecurity-experts-are-bracing-for-a-vulnerability-tsunami-and-theyre-using-ai-to-find-it/
2. Volunteer maintainer Ondřej Surý helped speed distribution of fixes for two serious PHP vulnerabilities, which could let attackers run code on affected servers (hindustantimes.com) — https://www.hindustantimes.com/world-news/volunteer-maintainer-ondrej-sury-helped-speed-distribution-of-fixes-for-two-serious-php-vulnerabilities-which-could-let-attackers-run-code-on-affected-servers-101666579294975.html
3. 'If Anything Happens to This Guy … Everyone Is Screwed' : r/PHP (reddit.com) — https://www.reddit.com/r/PHP/comments/17g4g5v/if_anything_happens_to_this_guy_everyone_is/
4. The Man Who Saved the Internet Yesterday. (democraticunderground.com) — https://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=439x12196024
5. Zwei Schwachstellen in PHP gefährden einen grossen Teil aller Webseiten (bluewin.ch) — https://www.bluewin.ch/de/digital/internet/2026/10/24/zwei-schwachstellen-in-php-gefaehrden-einen-grossen-teil-aller-webseiten.html
6. Critical Vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619 (cisa.gov) — https://www.cisa.gov/news-events/alerts/2026/10/23/critical-vulnerabilities-php-cve-2026-109618-and-cve-2026-109619
7. Two Critical PHP RCE Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 (crowdstrike.com) — https://www.crowdstrike.com/blog/two-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/
8. PHP2Shell FAQ: Critical PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) (watchtowr.com) — https://www.watchtowr.com/blog/php2shell-faq
9. Microsoft guidance for PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 - Microsoft Security Blog (microsoft.com) — https://www.microsoft.com/security/blog/2026/10/21/microsoft-guidance-for-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/
10. Impact of CVE-2026-109618 and CVE-2026-109619 - PHP Remote Code Execution (f5.com) — https://www.f5.com/company/news/security-alerts/impact-of-cve-2026-109618-and-cve-2026-109619-php-remote-code-execution
11. PHP RCE Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 | Google Cloud Blog (google.com) — https://cloud.google.com/blog/topics/security/php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619
12. PHP2Shell: Critical PHP Remote Code Execution Vulnerabilities – Unit 42 (paloaltonetworks.com) — https://www.paloaltonetworks.com/unit42/php2shell-cve-2026-109618-and-cve-2026-109619
13. Security bulletin – Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) (amazon.com) — https://aws.amazon.com/security/security-bulletins/AWS-2026-143/
14. Hackers Got Four-Day Head Start on Epic PHP2Shell Vulnerability (securityweek.com) — https://www.securityweek.com/hackers-got-four-day-head-start-on-epic-php2shell-vulnerability/
15. PHP2Shell Exploited Four Days Before Disclosure (infosecurity-magazine.com) — https://www.infosecurity-magazine.com/news/php2shell-exploited-four-days/
16. PHP2Shell: All You Need To Know About The Latest PHP Vulnerabilities (safe.security) — https://safe.security/resources/php2shell-exploit/
17. Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) (huntress.com) — https://www.huntress.com/blog/rapid-response-php2shell-leaked-critical-php-vulnerabilities
18. The AI-Discovered Bug That Could Have Become a Cybersecurity Disaster (time.com) — https://time.com/6240243/ai-cybersecurity-php-hack/
19. Critical PHP vulnerability discovered by AI could take down websites | Digital Trends (digitaltrends.com) — https://www.digitaltrends.com/computing/php-vulnerability-ai-wordpress-drupal-joomla/
20. This single bug posed a threat to '70% of the internet.' Here's how AI found it | CBC News (cbc.ca) — https://www.cbc.ca/news/science/php-vulnerability-ai-1.7005988
21. AI-discovered web vulnerability leads to scramble as hackers race to exploit flaw (theguardian.com) — https://www.theguardian.com/technology/2026/oct/21/php-vulnerability-ai-hackers-websites-wordpress-drupal
22. Early Exploitation of PHP2Shell detected four days before public disclosure (newscord.org) — https://www.newscord.org/brief/newscord-6379
23. AI-Enabled Cybersecurity Threats Exposed by PHP Programming Language Vulnerabilities (meridian.email) — https://meridian.email/p/ai-cybersecurity-threats-php-vulnerabilities
24. Government websites go offline after PHP vulnerability disclosed (emirates247.com) — https://www.emirates247.com/tech/government-websites-go-offline-after-php-vulnerability-disclosed-2026-10-21-1.701198
25. The cyber flaw scramble that brought the AI threat to life (soz6.com) — https://soz6.com/news/article_2026-10-24_5-16-16_62075775c7423e1f1c2428574c8b2a37
26. PHP warns of new RCE vulnerability with no patch available (bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/php-warns-of-new-rce-vulnerability-with-no-patch-available/
27. PHP Shares Mitigation for New RCE Vulnerability with No Patch (ground.news) — https://ground.news/article/php-shares-mitigation-for-new-rce-vulnerability-with-no-patch_3b2f56
28. AI Reveals Decade-Old PHP Bugs, Sparking Global Web Scramble (engineering.com) — https://www.engineering.com/story/ai-reveals-decade-old-php-bugs-sparking-global-web-scramble
29. Major PHP vulnerability could put countless websites at risk | Engadget (engadget.com) — https://www.engadget.com/php-bug-wordpress-drupal-websites-vulnerability-155556209.html
30. PHP Warns It Plans To Release 2 Emergency Patches Imminently - Slashdot (slashdot.org) — https://slashdot.org/story/26/10/21/2048232/php-warns-it-plans-to-release-2-emergency-patches-imminently
31. PHP2Shell (wikipedia.org) — https://en.wikipedia.org/wiki/PHP2Shell
32. ebuildersecurity.se (ebuildersecurity.se) — https://ebuildersecurity.se/
33. ctvnews.ca (ctvnews.ca) — https://ctvnews.ca/
34. clarin.com (clarin.com) — https://clarin.com/
35. php2shell.com (php2shell.com) — https://php2shell.com/
36. tidbits.com (tidbits.com) — https://tidbits.com/
37. trendingtopics.eu (trendingtopics.eu) — https://trendingtopics.eu/
38. unn.ua (unn.ua) — https://unn.ua/
39. getastra.com (getastra.com) — https://getastra.com/
40. criticalpathsecurity.com (criticalpathsecurity.com) — https://criticalpathsecurity.com/
41. socradar.io (socradar.io) — https://socradar.io/
42. cynoteck.com (cynoteck.com) — https://cynoteck.com/
43. thehackernews.com (thehackernews.com) — https://thehackernews.com/
44. cybernews.com (cybernews.com) — https://cybernews.com/
45. theguardian.com (theguardian.com) — https://theguardian.com/
46. techradar.com (techradar.com) — https://techradar.com/
47. indiatimes.com (indiatimes.com) — https://indiatimes.com/
48. moneylife.in (moneylife.in) — https://moneylife.in/
49. scworld.com (scworld.com) — https://scworld.com/
50. conscia.com (conscia.com) — https://conscia.com/
51. bisi.org.uk (bisi.org.uk) — https://bisi.org.uk/
52. blackduck.com (blackduck.com) — https://blackduck.com/
53. watchtowr.com (watchtowr.com) — https://watchtowr.com/
54. checkpoint.com (checkpoint.com) — https://checkpoint.com/
55. aiweekly.co (aiweekly.co) — https://aiweekly.co/
56. thesouthfirst.com (thesouthfirst.com) — https://thesouthfirst.com/
57. thestreet.com (thestreet.com) — https://thestreet.com/