# Critical PHP Vulnerabilities 'php2shell' Trigger Global Cyber Warnings

> Two remote code execution flaws affecting 70% of websites were disclosed, leading to urgent patching and site shutdowns worldwide.

By PrimaryBrief newsroom · Published 2026-10-22T01:05:55.162254Z
Canonical: https://primarybrief.com/article/critical-php-vulnerabilities-php2shell-trigger-global-cyber-warnings-277bcc1b

On Wednesday, October 21, 2026, two critical remote code execution vulnerabilities, collectively dubbed "php2shell," were publicly disclosed in the PHP programming language, which underpins approximately 70% of websites globally [3][8]. The flaws allow attackers to execute arbitrary code without prior authentication, prompting government agencies and cybersecurity firms worldwide to issue urgent warnings and leading to the precautionary shutdown of numerous websites [2][4][8][17].

These vulnerabilities pose a significant threat to global internet infrastructure, potentially allowing widespread data theft and service disruption for millions of websites that rely on PHP for backend operations [3][12].

## Records Show Critical Flaws

The vulnerabilities, CVE-2026-109618 ("RCE via OOM corruption") and CVE-2026-109619 ("RCE via stale global state"), each received a critical severity CVSSv4 score of 9.2 [8][9][17]. CVE-2026-109618 exploits PHP's out-of-memory handling, which can leave request memory partly initialized, allowing for arbitrary code execution through out-of-memory triggers [8][10][11]. CVE-2026-109619 targets PHP's `session.upload_progress` callback, where request-owned internal state can persist after its memory has been freed [8][9]. Both enable unauthenticated remote code execution with web worker privileges [17]. The exploit body for CVE-2026-109619 is approximately 450 bytes, making it difficult to block with size-based Web Application Firewall (WAF) rules [8]. Affected PHP versions include 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12 [9].

## AI Assisted Discovery

Researchers from OpenAI, Google-owned cybersecurity company Wiz, and cybersecurity firm Calif discovered these flaws in late August 2026 [12][15]. Calif identified one critical flaw using OpenAI's GPT-5.6 Sol model as part of the "Patch the Planet" initiative [13][15]. Wiz independently discovered and reported both vulnerabilities, employing Google's Gemini 4 Argon, Wiz Atlas, and OpenAI's GPT-5.6 Sol in their research [12]. OpenAI stated that AI found these vulnerabilities before attackers did, creating a "Defender's Window" to prepare fixes [15].

## Immediate Response and Warnings

The PHP Foundation released security patches on October 21, 2026, advising website operators to update their systems immediately [4][12][18]. The recommended updates are to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 [9]. For those unable to update immediately, mitigations include setting `session.upload_progress.enabled=0`, `fatal_error_backtraces=0` (for PHP 8.5.x), enforcing `memory_limit=-1`, or setting `pm.max_requests=1` [9]. PHP confirms there is no complete configuration mitigation available [9].

Globally, numerous government websites, including some in Europe and Australia, were taken offline as a precautionary measure to implement the urgent patches [1][2][4][12]. The Australian Signals Directorate (ASD) was among global cyber agencies urging organizations to act quickly, as hackers are believed to be exploiting these flaws [2]. The National Security Agency (NSA) also issued strong warnings, urging immediate patching and recommending taking affected systems offline if patching is not feasible [18]. The Cybersecurity and Infrastructure Security Agency (CISA) issued strong warnings [12]. Companies like Amazon also issued warnings about the newly detected cyber flaws [5].

## What We Could Not Confirm

*   The exact number of websites that have been taken offline globally due to the vulnerabilities.
*   Specific instances of active exploitation of the "php2shell" flaws by malicious actors as of October 21, 2026.
*   The full extent of data breaches or service disruptions directly attributable to these vulnerabilities.

## Evidence cited
1. Australians facing spike in data breaches after 'critical' flaw uncovered (www.abc.net.au) — https://www.abc.net.au/news/2026-10-22/data-breach-warning-after-ai-uncovers-critical-php-flaw/107295516
2. Australian government sites among those exposed to 'critical' software flaw (www.abc.net.au) — https://www.abc.net.au/news/2026-10-22/php-vulnerabilities-cyber-asd/107294812
3. World leaders warn of security flaws found in PHP programming language (www.aljazeera.com) — https://www.aljazeera.com/news/2026/10/22/world-leaders-warn-against-security-flaw-found-in-php-computer-programming?traffic_source=rss
4. PHP developers say key patches available after global scare (www.dw.com) — https://www.dw.com/en/php-developers-say-key-patches-available-after-global-scare/a-79725938?maca=en-rss-en-all-1573-rdf
5. Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’ (www.ft.com) — https://www.ft.com/content/245778d9-597b-492d-b5b6-a2967c77e853?syn-25a6b1a6=1
6. PHP warns it plans to release 2 emergency patches imminently (arstechnica.com) — https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
7. Read This Website While You Still Can (www.theatlantic.com) — https://www.theatlantic.com/technology/2026/10/ai-hacking-apocalypse-began-last-night/689106/?utm_source=feed
8. abstract.security — https://abstract.security/
9. google.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQERBFknENjP8pNl2XusoOnqH7GKHLRbWbDwMyTM61s3gsnOOZXWIEcJ5RJgeAMEee2qS-w14G-RyBhg_9itgn27T51ix96knuU4qVpgehAz93xfZbtVkzZxgkRoF2J9WwinkZ60lOmhsVRKP07muV8zGcnX5ukZfYH6VUwvpL6u3IKw7xDKaJbfvIL4RO6W88MGBltJybMQ7A8HowOCTzWbbnfF36bWS1BI4TBRCGOjt8EnQOzUAOUUi70
10. paloaltonetworks.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEy0ovPGT-dbP1wKcBa5hK8_i4DPQrJCB2B3Ze005scKudxnWCVS4xwd93lwSxyOCvQgm0LFpHA9EnQdDb0KupP_ZZSmGW0lUhBJtCFSciK4P2X1deM-iB8WzxzUQr3OfkmqpL_EBvU2YvKgBb-7XCO
11. amazon.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFxcDOKgNrTZJv2m1laMhlxjAyCH_lXwQGKg3FdRv62YU2AxGdx2OT539NqDaAulYwAVckyve2_I8rjcxkRFkwmDs1yiVmw8YWG1bWZ3Tpn5qMZc07HKuG5fSbbeddaIGw-7hRxxxCh4UP6DCUaX8asgr1X
12. cnn.com — https://cnn.com/
13. mashable.com — https://mashable.com/
14. cybersecuritydive.com — https://cybersecuritydive.com/
15. openai.com — https://openai.com/
16. forbes.com — https://forbes.com/
17. rapid7.com — https://rapid7.com/
18. nsa.gov — https://nsa.gov/
19. thephp.foundation — https://thephp.foundation/
20. cisco.com — https://cisco.com/
21. zafran.io — https://zafran.io/
22. imperva.com — https://imperva.com/
23. jfrog.com — https://jfrog.com/
24. cisa.gov — https://cisa.gov/
25. wikipedia.org — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFUfgEIv06szVY00-hD3uOIH_hUWJ-rEhzwpV2Y_W2HuoEvjyAkDdziNUb_5vGPfGRHOygLWy52aKhWlrMI9vbHY1S6Tzga8k3CBVDViaaiwF80YQ6nexjpxVdwbiehzcAv
26. microsoft.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFtmpiiOK8JKFn-JM2eUDodHmdPCzq0F2DJTadzBEhY7YGkBuLKbQObjWlid4iImgIVc28H3HWoEltPAxlx3hG0fZJ6MJBgKoc7Ipzn4GSd7evY6NuyNIDYfXdxQ44n4b_rxYcB785ULIyiTH4YSwIB9e2CBLjSRVjzC7X2paVqAJHsPlIbMQ1roUfmEC9dsinfWbZa3RNt9Vf41qDkPtFDlKMURcjWLSDNPVbGHcHQ_8Fg4fx3nBi57fDmKPNWCRC1umqGDPeAPvI8pnvxGG9frCBKLRk=
27. qualys.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFoxbeP_s6Q7wERIf6-Z30BZP8pSfZm1cHIDYnldrWpe3akXMQNEvn3-YXmydGeMSTgVPG1K0VVlb6RDlMvW81kRh4Y6fs0HcGQ79gUzyHsBDIWS2JQZsrQqCw5_AF3lQ6Zy9Lder5aziGR2WQic2UlT-Zs2fwxuSzAtGyvuzGOJxbr8LPsd0Dv0K-DX-RbsbTPH2b-pref6keSnv4WL32Zv4Gh1VaYBSTeEpeHnV7pDcZSpLm6ung5S5zFfD0=
28. thehackernews.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHlD8pK-eQhZwZOrNHEsUNwMjAVbIKglbaI-oX8tBx8oKCMulBsT-ApIrqtbjD1O8BZguo4o5fGKNnKKBz8Ypz2kcxX45zMuUNUb8_lq6VJsyZ6qT006hSZd4eUBvhXUTDDbssdysHRxgqI7og75l6a5DyH5v9o5GiDRv8K7zqHyvCfOATP
29. cisa.gov — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGKkrMbz2lqzM1GN3wl0BgmCbFkIqRHPOHb_8O-aOM6kzp7ThU1V-pos7FUkQGUOrf5BmAPlOgs_2r8cnh9vOP7lzIk4H6RU1X5OUiGB5euloyTaWBHYbkJSR0lNLjtEnOeHWGUeUOJuyvQU-RXJHxbzka6Z34OpSFHUJ-iEe8ElQ9tEvL4nHZQLXzQm2Z2zDy5eFFIRdOElR4x6dZdQNFRjD_Osw==
30. europa.eu — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFjMWxODv4ShU9zwVBbicarkdpllEtqr7FEc5WX1Eig04iHBvdZ5jSv8YIz4bTYfmSkI6utqfN2WrtVNARmTi4SzMKhOEPnWicqDNFDRZEQn-njrAPHR208RPv7kSRxd-4SEHEkv8gj_iOAsjTOLZpqbkRr_65E4PBJ077txB8=
31. mysites.guru — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEGmSTi8lXaakq96GnxDA8kgzjR0MEv5Ap6GuXMt5jo2DM_-NyL47ZaRziLTqC9S2ljN5Bv6p4eqZGakHUkpuEMs8vodY3v1Hk_F4ocOvYaQjNMv3Xb91Wo1rXlDhG7E5-PD3iC0-p3qQsZN8rtL6FpK38UP3Id8gSsa5DinxYKnLySnA==
32. rapid7.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFXB9ZudROWA2U6-UsU4WCF5HeYSlYMIP6vdblFM9FD7IV75TFrTehsC5H2CNJUlBmmaWPjhQY_jROrCkRVvsPh6B9sTZvzjDANo9tuIENUaSYzcOc9RR63uyBjqUWD9FurZGrE7umM0q3yz07xM8P-OkbXMxoR34WazIUT6HwAY5EpEDypRJW5vurDwBDH_EcP9XBnDLBWoZEz1DcyWzQIN8lWcXVgySPq04mFTGVq0WFiUzP_g62vpw==
33. europa.eu — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEVrrUBd__yvcgX4FDhG28Tc5Zn4R0Xq6KHil_wUOIz7jwfIlB8rtuYAcnXuM3bG-JqKdk2ifg01BlLdej6-IqgITkImhj9WUdnkxbsQqGBH22tAAU1Xz5SOK00Q8fqSY1PGvKfwV6yK5QA6cJ5d_GlTyUqiASowxoH2w==
34. thephp.foundation — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH1pcuYfC1wyq0OW3cixryvgu0uzLYcZfDnP6d8noHN2GLAZIkRTs23YJIeBivUay2WAkmKx26TBrocCX9l9iNheyuvCL_POwmcU3mZbRhSYDfYCxTNxkCaDG1nzn9scFacIVGlKcCXdaLa-Yc4PBMMoUREp9OKveE1xzAR5oYPMRaMhl1oSKJdTSHc4BDi3dOBeuy6fjnOGAyJ-xgWvSGIfU0H56ejTPU=
35. runzero.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGPx-0jkSaVX8T7ECzVaNx0hkm8C3_d8LcZw6wdyaxYaaUh8iUvuYEFBcH_5-nTjxAxSTpWc4zE9GqpxMR67wMLuapuJasWtE1AX6HkqgjXwenwO9jzi7iYnFZN
36. armis.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHRdCCBflxthTvAv2cGDg5SrdWxFLsuMsyuZ2WHeG5lGlDBTBddpmKhN75t1t3tFDL_jM_A6psP1ZWnN8kBAwDkTpVH9Dg6gd-QdMHdMSKSRH3EhqgUuh22GNIvUDZhomxrd-U6U8ttH-JBHgjRoYGvPjSNyPFq_AG16FSwGv-Kfm5KO6ZJGos4EiWK3JDUHomL
37. sentinelone.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQErH_qVLGPumbgmvYvpr8nQbA5qN7rci5I1TeWECUu7wo7LFvsWZnAgBR9LAdCK0MKZvHLyKFuSmoZwJqryjf75YSapyR-bclsWXRkjvQgozVyvjkZJJRT_41-BoX89JW_dcS9_RjgyQZq__SwaBz3vbTb-UCg6E6tAl4nY6NVh5Xth0UJH1_9gAGU1tO1bMgtCZztuqA5hFa7t00MNu-AzEweuLW53YoPXTUS0
38. sliplane.io — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHGqLtFkEteqba99vrhkRpwGSxdaYJUKn_vZsZaM3Gd14KHNeqY_iwXoBpCuhrxjAcigot1FmYVuZMzJ3rzy3i3RE2Q3Fuhzg1LOrSlAtkWxS1mQyhb-jELWJpsY8k7FT-nfWfc3P0hLCOAwFxSXXUC0kiWp1XCTRTV0Bjmhe8NdlLt
39. cisa.gov — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGszgLmrOW1lkFTqak83AK1jd4PAqRCBMbxK4tj7PL0SxAepaXkpo-d0dQ0CbH8uVQuWyHsX0ZXsAwzX5ZYnkpWb4pYjczJl6W9oA8lk2106yY4m9BD1P9Kzg0CR5IZwAyTLl0UWNMIRAeOguV_6PcOhu6jQaUoGflGei46yRRzHhCoQRXqHijyxt-Uji63tOJyczomFb9MoKobVvyfij8o0FNnFg==
40. scmagazine.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF8P_a7FD1PYPz-bUuPgczfZkrfqFQRBTkau87ea_obguyV76pgRkXFRvpAZCM7Jji_x8b_MK-i8p2P3ixa0srM0ge8SSS-09gjtiF92YKwOPo_Yz6_jcNYMJjxrltbuCz3SfzTTZTVmicZybOmldVHSMZL9VPY6-cyrV9A2Qg2n3Vb4b6oL9QozTaZ0uAllg==
41. tanium.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHL9Xxn-1cTTSEH2nxvftFAtEpg7e15YNi8vdHl2rbREJ4XVVXGQU38PsJhIRX3slspqxDaEPDBeoyMz96OZAHSucWhBFbxJHZjBqugRWKzwm5hj686CdRGYkOxrsB7BZfkNS8XWd0G-FZOkY6byDErxtbuoUINCq8U6Tk1b3QhWV-UxAOUhORmzFmmK3nB4E1Y
42. meritalk.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFV88QgpLzzQ5uAHvC5hlzn8PGLrYPEeskG3ZQAhwSr6_oc5hDUxMKubAioVsIZUdTsHYjovbFSK1Q-z0pZNsVF6TaFkP5DuD85dIB1ytMvuDcqU7p63K01UmLs6EFx45hlP93p0raXivn1WNHcGMTIHyAEwZR75tkP9wLLKb7aPaE9fZHRMEYQqbomr-d-OCs=
43. qualys.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFGdshGIIumCqcoUD12eca2cXmMy2rzyom-m47QCTAy4siU1pCktvFy9wGrpTk9GCgZR_Bag2c0niTfyAMnvOOux_Br9grZ9wJ9M6nOJB-XPhgtH9VDTIFrGAPCFHxvfMJ7DDslDkbAXEg8awztF11m0qBhITHtsj1gddC4dXQvYoU69r_yc6difcsnfgMZJ4srlmWRshp8vBoHEmy40MVg0osus2DRDwVK2AgXyw73AmGwRiSoalJEk-E9YI=
44. aikido.dev — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEAn7GH26WqE1966poDYqe8abM-JK_xuE5c7KZEnynP1chuDKazW8A3K4zFKDvleY1C2tuULst6rGU6wOfgDXjx5KZaCqZR4iE11ve4_8Q1szOxw9LIIhBUMT5CGsN515lRBsKKqWCc90VAkJjcGShpuXfLjzPD1opINYD_ZmOB
45. google.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH2NFN91Mb1JxMKS2dE8rkWae4o4IQ-Q41pThvrWu3BV0iX0OqFtZV9xrBAO5VffQT_fNc1-8eSNjSu27eNtffYyjqbeSeTsQN-RwFNPNCWP0iU5830Nv2PW8u_FrsD-J5QUVVwJwZEI7j7s61kdepk71I8EN8ygOsyafqCNsQxzADDmvnX5pPYZP2p5j10UlEiQ8RRzWXhGEA26CFbm6NDIFyTP4MrjR5L5_wGZcA4lV0PKYg-ZoZMaA==
46. tenable.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH9qh93vto_tTpcprD02fbmSCrBKOzwYGaPkAuWWO8VExrwA0hmS1UpyNEmcgShg7txud-Fd9yW6HnLZ_H8yEkvIeGPdNeB2RGdCH4ZD1T16CgCFpHkZWrUCzIw57PhSK2JlieNxUTaL91wN3yfjFJVT2aezYnrXzdzIWX6n5iuKv45uoOcPWcDoIjExCUgGqbZljPUUsG5mtgcXdoFzNz6RMz9zWHecwVL01shqN31lPUR5p1H
47. cyber.gc.ca — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFw-_Hmxa8C6CpDhihJLmY-Eg9vkTUPE-qL5VJXKbptZRJimVtDF61DQFp4LJWeFmI0dyH-1zcezxwD7cskf5cG4JV8hkQ4Fai5uLMZe0RiBXn4FO_FnyqTg59_Tobdj2qvkGs3oGpHwirNxVf9y4vJsrgyaroX63ECmZ1y0h-LPGbUw0xnpRJL7j7Bi1BbJgI9xZX8S1ZGy9-cInMSZcZZMkVw5fn3PNW0BSYuovuqPCOAtLS0ZQ==
48. laravel-news.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHuH5qObvdiDa-762LiYEIKzedvhWZcNdXqKfbyIM9Uqti0g48tPfP3y4HRBaj5Z8Yrjae_k_n4WnBv62AfCKSixfNwjPZlC7pISc6X4IVWaOQX60u0JPCrMO1UppvY0aSjB9KGFfpimVc8mPNoRtZYQq4ePOs=
49. huntress.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEQenLxbKvQ3MHzj9NJ00Mrpl2ojilQJYo58fR4-YZs3VIYCAysnmy-3ywEZJGOnEZF-82YaGHCrigcBcQ6N9oYuQenZ_Z-1zZoCoq_h6r_4RNdDfm3V-zfbvY5o8uo8DC9fL-sftQ2Aq1ydsKI1aEbIowtyVApA3g6w4qTdc_T50s-Dotc
50. virtfusion.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGImB9FVVU2QMIFDP2Voy5kJS6zpFJO46iDBtevOmWZHfMznpkOAXPv6lGxkWkxgAaUdir9kY3G4Nn22ya582WimmZ_mS7AO3Wend4fRwKfQXZXrHxx7RsJM0IqpliRehEOnULbmldJTNFyS0D652V9
51. rescana.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEAUDhEQl-BMrNaLx0VRjtJqsdgYuymIZHjZzBzZR0cIJ-eU7--Q8t8jCT0O54IAxWxiET6wWvzfq0TL-xO3lXkh0Lp4MacaFqDrA8u0DipvxBxHnQ6m3lg6KTBK7VmVLSzzUaVfX3-CXGiUWsJ3foJzk05J37WZvUFCwyEJq7d6SqgPg==
52. patchstack.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH39krC1FL3Bm4xzXYry1U94F7a6I2MkiUseutuwLajGHi5fGBOXzQqKAuWTP6XF_aYSqPrvkjA0gckrvPLgiYx9Czlv3n_QLv4vynGn1xX27zDWYuWZca7qMCarpct4D6TB7n_4jOl4PlYPTTIp0a98rjP3l7mXudF78c3nO2tCw==
53. socradar.io — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEzDyM_OIvk1GSMJJwBDeDE_UjrmhzFRgibiE0JIoCIt6ML3lw0xCa6wvx1FYG7rqv1fmX1QWuxlWU-Wk_hFCTsPeArSxXim9q3g-XUpCkAHlUttTJXRj5lO3OTNW2euCCMAX2XjEEFhx2tuQGYEbeG12QzRWzauMRr38ytOA==