Critical PHP Vulnerabilities 'php2shell' Trigger Global Cyber Warnings

On Wednesday, October 21, 2026, two critical remote code execution vulnerabilities, collectively dubbed "php2shell," were publicly disclosed in the PHP programming language, which underpins approximately 70% of websites globally[3][8]. The flaws allow attackers to execute arbitrary code without prior authentication, prompting government agencies and cybersecurity firms worldwide to issue urgent warnings and leading to the precautionary shutdown of numerous websites[2][4][8][17].

These vulnerabilities pose a significant threat to global internet infrastructure, potentially allowing widespread data theft and service disruption for millions of websites that rely on PHP for backend operations[3][12].

Records Show Critical Flaws

The vulnerabilities, CVE-2026-109618 ("RCE via OOM corruption") and CVE-2026-109619 ("RCE via stale global state"), each received a critical severity CVSSv4 score of 9.2[8][9][17]. CVE-2026-109618 exploits PHP's out-of-memory handling, which can leave request memory partly initialized, allowing for arbitrary code execution through out-of-memory triggers[8][10][11]. CVE-2026-109619 targets PHP's session.upload_progress callback, where request-owned internal state can persist after its memory has been freed[8][9]. Both enable unauthenticated remote code execution with web worker privileges[17]. The exploit body for CVE-2026-109619 is approximately 450 bytes, making it difficult to block with size-based Web Application Firewall (WAF) rules[8]. Affected PHP versions include 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12[9].

AI Assisted Discovery

Researchers from OpenAI, Google-owned cybersecurity company Wiz, and cybersecurity firm Calif discovered these flaws in late August 2026[12][15]. Calif identified one critical flaw using OpenAI's GPT-5.6 Sol model as part of the "Patch the Planet" initiative[13][15]. Wiz independently discovered and reported both vulnerabilities, employing Google's Gemini 4 Argon, Wiz Atlas, and OpenAI's GPT-5.6 Sol in their research[12]. OpenAI stated that AI found these vulnerabilities before attackers did, creating a "Defender's Window" to prepare fixes[15].

Immediate Response and Warnings

The PHP Foundation released security patches on October 21, 2026, advising website operators to update their systems immediately[4][12][18]. The recommended updates are to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35[9]. For those unable to update immediately, mitigations include setting session.upload_progress.enabled=0, fatal_error_backtraces=0 (for PHP 8.5.x), enforcing memory_limit=-1, or setting pm.max_requests=1[9]. PHP confirms there is no complete configuration mitigation available[9].

Globally, numerous government websites, including some in Europe and Australia, were taken offline as a precautionary measure to implement the urgent patches[1][2][4][12]. The Australian Signals Directorate (ASD) was among global cyber agencies urging organizations to act quickly, as hackers are believed to be exploiting these flaws[2]. The National Security Agency (NSA) also issued strong warnings, urging immediate patching and recommending taking affected systems offline if patching is not feasible[18]. The Cybersecurity and Infrastructure Security Agency (CISA) issued strong warnings[12]. Companies like Amazon also issued warnings about the newly detected cyber flaws[5].

What We Could Not Confirm

• The exact number of websites that have been taken offline globally due to the vulnerabilities.
• Specific instances of active exploitation of the "php2shell" flaws by malicious actors as of October 21, 2026.
• The full extent of data breaches or service disruptions directly attributable to these vulnerabilities.