PHP2Shell

PHP2Shell
CVE-2026-109618
CVSS 4.0 score9.2
CVSS 4.0 vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.x score9.8
CVSS 3.x vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-109619
CVSS 4.0 score9.2
CVSS 4.0 vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.x score8.1
CVSS 3.x vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Date discovered1 August 2026; 3 months ago (2026-08-01)
Date patched21 October 2026; 20 days ago (2026-10-21)
DiscovererCalif, OpenAI, Wiz
Affected softwarePHP versions 5.4–8.5
Websitephp2shell.com
Wikimedia's Phabricator instance as seen hours before the patch, disabled as a precaution

PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE). PHP is a popular programming language on which many website and web application codebases are built; these vulnerabilities were estimated to affect nearly 70% of websites at the time of their disclosure. The vulnerabilities were discovered with the help of AI in August 2026 and their existence was publicly announced on 20 October 2026. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits (software that uses a security hole to compromise a computer) could be used.

Discovery

The vulnerabilities were independently discovered by two parties: by Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026; and by the Israeli-American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability. Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research. Wiz coined the name "PHP2Shell" indicating that PHP exploits would enable execution of shellcode on affected servers.

PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so, and a specific exploit had not yet been discovered, so the issue was not prioritized.

The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0.

Patches

The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12). Source code patches were released for versions 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life. Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice. Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems. Volunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versions from the patched source code so that server administrators could automate deployments without compiling PHP themselves. In response to claims on X (formerly Twitter) that unpatched older PHP releases left one-third of the Internet permanently vulnerable, Surý stated that there were ways to patch and update the older versions as well.

The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the internet. The leaks occurred in an anonymous post on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released. One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release". Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed.

Impact

The potential impacts of the vulnerability were widespread. According to web survey provider W3Techs, among websites whose server-side programming language is known, approximately 69% use PHP. This includes websites that use content management systems such as Drupal, Joomla, and WordPress. PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications.

Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. Some Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyber Security. The US National Security Agency recommended that websites go offline if unable to update immediately. The NCSC released a similar warning, urging organizations to be wary of backdoors. The Japanese National Cybersecurity Office advised PHP users to immediately update their systems. The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws.

The Wikimedia Foundation shut down many of their supporting services, and forum sites such as 4chan and Something Awful went offline. Several Japanese websites and applications also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, Street Fighter V, and numerous e-commerce sites. The Internet Archive briefly shut down to fix the issue.

Analysis

Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used by about two-thirds of the web at the time. Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk.

Commentary in The Guardian noted that The PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment.

Exploitation

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October in MadPot telemetry, four days before public disclosure. Cloudflare reported signs of early exploitation prior to public patch release and deployed temporary web application firewall rules as an attempted stopgap mitigation against the vulnerability. Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day.

On 25 October, security researcher Jaydip Modhwadia exploited PHP2Shell to achieve remote code execution on a server running an unpatched version of PHP during an online security challenge called "Steal My Bitcoin", demonstrating that the vulnerability was exploitable in practice.

See also

References

  1. ↑ "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet". Wiz Blog. 21 October 2026. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  2. 1 2 Collier, Kevin (21 October 2026). "Critical vulnerabilities in commonly used web code spark rush to update systems". NBC News. Archived from the original on 25 October 2026. Retrieved 21 October 2026.
    1. 1 2 Citing "Usage statistics of PHP for websites". W3Techs. Retrieved 23 October 2026. PHP is used by 69.2% of all the websites whose server-side programming language we know.
  3. ↑ "PHP: News Archive - 20 Oct 2026". PHP. 20 October 2026. Archived from the original on 20 October 2026. Retrieved 21 October 2026.
  4. 1 2 3 4 5 "PHP: News Archive – 21 Oct 2026". PHP. 21 October 2026. Archived from the original on 20 October 2026. Retrieved 21 October 2026.
  5. ↑ Volz, Dustin (8 September 2026). "A Hacking Tool Built With A.I. Can Breach Phones Without a Click". The New York Times. Retrieved 21 October 2026.
  6. McMillan, Robert (21 October 2026). "Exclusive | AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk". The Wall Street Journal. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
    1. 1 2 "Ryan Austin, a researcher at Calif, uncovered the flaws with help from GPT-5.6 Sol, one of OpenAI's most advanced models, during an audit of PHP's source code in August. ... Researchers from Google's Wiz cybersecurity team soon reached out with new exploits, which they had discovered independent of Calif."
    2. ↑ "The class of bugs had been hiding in PHP's source code for years. A security researcher had flagged it as a problem area decades earlier, but the flaw had been considered too difficult to exploit and was largely forgotten, Duong said."
    3. ↑ "News of the patch leaked out Tuesday, in a post to Hacker News, just under two days before the patch release."
  7. 1 2 Satter, Raphael; Marchandon, Leo; Ghosh, Kanjyik; Pardesi, Rajveer (21 October 2026). "Government websites go dark after AI-discovered flaw sparks security scramble". Reuters. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  8. ↑ Group®, Insikt. "PHP2Shell Exploitation: Two Critical PHP Flaws Explained". www.recordedfuture.com. Retrieved 25 October 2026.
  9. ↑ "PHP: Releases". PHP. Archived from the original on 12 November 2006. Retrieved 22 October 2026.
  10. 1 2 3 Kan, Michael (21 October 2026). "This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says". PCMag. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  11. 1 2 3 Constantin, Ana Maria (21 October 2026). "PHP knew about one of the flaws in 2024 but could not agree a fix". The Next Web. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  12. ↑ "Today's PHP Security Release, and How We're Strengthening PHP Security". The PHP Foundation. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  13. ↑ "php.announce: [ANNOUNCE] Upcoming Critical PHP Security Release". PHP Lists. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  14. 1 2 Abrams, Lawrence. "PHP warns admins of two critical flaws, emergency patches coming tomorrow". Bleeping Computer. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  15. ↑ "RCE via OOM corruption". 21 October 2026. Archived from the original on 21 October 2026. Retrieved 21 October 2026 – via GitHub.
  16. ↑ "RCE via stale global state". 21 October 2026. Archived from the original on 23 October 2026. Retrieved 21 October 2026 – via GitHub.
  17. ↑ Scherzer, Daniel (22 October 2026). "Blog: PHP2Shell: a Timeline". scherzer.dev. Retrieved 22 October 2026.
  18. ↑ "Critical PHP Security Release - CVE-2026-109618 and CVE-2026-109619". cPanel. 22 October 2026. Retrieved 23 October 2026.
  19. ↑ Galov, Niko (21 October 2026). "PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection". CloudLinux. Archived from the original on 23 October 2026. Retrieved 23 October 2026.
  20. ↑ "The PHP developer who became the unsung hero of the internet". BBC News. 24 October 2026. Retrieved 25 October 2026.
  21. ↑ Warzel, Charlie (22 October 2026). "'If Anything Happens to This Guy ... Everyone Is Screwed'". The Atlantic. Archived from the original on 23 October 2026. Retrieved 23 October 2026.
  22. ↑ "Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming". Hacker News. Archived from the original on 21 October 2026. Retrieved 22 October 2026.
  23. ↑ Goodin, Dan (20 October 2026). "PHP warns it plans to release 2 emergency patches imminently". Ars Technica. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  24. 1 2 Gerkin, Tom (21 October 2026). "Websites taken down worldwide as critical PHP cyber-security update issued". BBC News. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  25. ↑ Hammond, John (21 October 2026). "Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)". Huntress. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  26. ↑ Van Dessel, Josse (21 October 2026). "Major websites go offline as critical PHP vulnerability triggers security fears". The Brussels Times. Archived from the original on 25 October 2026. Retrieved 21 October 2026.
  27. ↑ "Critical security issue affecting PHP" (Press release). National Cyber Security Centre. 21 October 2026. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  28. ↑ Beauchemin, Genevieve (22 October 2026). "Canadian apps and government websites go offline to ward off online danger". CP24. Retrieved 23 October 2026.
  29. ↑ "NSA Advisory: PHP Updates". NSA Press Room. 21 October 2026. Archived from the original on 21 October 2026. Retrieved 21 October 2026. Effective immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.
  30. ↑ Booth, Robert; Down, Aisha (21 October 2026). "Flaw in PHP computer language leads to shutdown of websites around world". The Guardian. Retrieved 21 October 2026.
  31. 1 2 著名ITサービス相次いで緊急メンテへ コドモン、シャドバ、BASE、さくらのレンタルサーバなど 「PHP」脆弱性に起因か [Several prominent IT services—including Codmon, Shadowverse, BASE, and Sakura Rental Server—have initiated emergency maintenance, likely due to a vulnerability in PHP]. ITmedia (in Japanese). 21 October 2026. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  32. ↑ "Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threat". CNA. 22 October 2026. Archived from the original on 23 October 2026. Retrieved 23 October 2026.
  33. ↑ "Critical Vulnerabilities in PHP (PHP2Shell)". Cyber Security Agency of Singapore. 21 October 2026. Archived from the original on 23 October 2026. Retrieved 23 October 2026.
  34. 1 2 Tauber, Olivia (21 October 2026). "PHP vulnerability: Which websites and services are affected?". Mashable. Archived from the original on 22 October 2026. Retrieved 21 October 2026.
  35. ↑ Scullion, Chris (27 October 2026). "Capcom has temporarily delisted Street Fighter 5 and turned off its servers as it works on PHP security issue". Video Game Chronicle. Retrieved 28 October 2026.
  36. ↑ Smith, Paul; Mizen, Ronald (21 October 2026). "AI just discovered a bug putting 70pc of world's websites at risk". Australian Financial Review. Archived from the original on 23 October 2026. Retrieved 22 October 2026.
  37. ↑ Eadicicco, Lisa (21 October 2026). "Global websites shut down after AI found a critical flaw affecting 70% of the internet | CNN Business". CNN. Archived from the original on 25 October 2026. Retrieved 22 October 2026.
  38. ↑ Adam, Karla; Volz, Dustin (22 October 2026). "What Is PHP? Why Are Government and Business Websites Going Offline?". The New York Times. ISSN 0362-4331. Retrieved 22 October 2026.
  39. ↑ Taylor, Josh (22 October 2026). "What is PHP, and how bad is the computer language flaw causing website shutdowns globally?". The Guardian. Archived from the original on 23 October 2026. Retrieved 22 October 2026.
  40. ↑ "Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog". Amazon AWS. 21 October 2026. Archived from the original on 21 October 2026. Retrieved 22 October 2026.
  41. ↑ Gatlan, Sergiu (21 October 2026). "PHP ships emergency patches for critical PHP2Shell flaws". Bleeping Computer. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
  42. ↑ "Hold on to your butts: Web admins braced for emergency PHP updates to plug leaked exploits". PC Gamer. 21 October 2026. Retrieved 21 October 2026.
  43. ↑ Knecht, Dane [@dok2001] (21 October 2026). "PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. [...]" (Tweet) – via X (formerly Twitter).
  44. ↑ "PHP RCE FAQ: PHP2Shell CVE-2026-109618 & CVE-2026-109619". watchTowr. 20 October 2026. Retrieved 21 October 2026.
  45. ↑ "UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest". The Register. 26 October 2026. Retrieved 27 October 2026.