Source: Help Net Security
Government agencies and businesses in Europe and the United States took their websites offline on 21 October 2026 after the PHP project released emergency security updates for two critical vulnerabilities that researchers have named PHP2Shell. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow an attacker to achieve unauthenticated remote code execution on a vulnerable web server, potentially seizing full control of it with a single request. The UK National Cyber Security Centre urged organisations to take offline any system that cannot be fixed right away, and the US National Security Agency gave the same advice.
What makes these flaws different
The most striking part of the story is how they were found. Researchers at Wiz, working with the security firm Calif and OpenAI, showed that the underlying defects had been present in PHP for decades, but chaining them into a working exploit was so complex that it sat at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a dormant flaw into a live exploit. Censys scans suggest around 2.58 million internet-facing hosts run PHP, and the affected versions stretch back more than a decade. Wiz ranks the discovery among the most severe vulnerabilities in PHP history and compares its likely impact to Log4Shell in 2021.
Exploitation is not theoretical. Cloudflare deployed web application firewall rules within hours of disclosure, Amazon’s honeypot network recorded a PHP2Shell exploitation attempt four days before the details went public, and proofs of concept are already circulating. Because PHP sits underneath WordPress, Drupal, Joomla and Magento, the exposure reaches far beyond any single application, and forgotten or unmaintained sites are expected to be a problem for months to come.
What to do now
The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team has also released minimal source backports for PHP 7.4, 8.0 and 8.1. CERT-EU advises organisations to patch affected assets immediately, and where that is not feasible, to isolate internet-facing applications until a fix is applied and verified. If your team runs PHP workloads in the cloud or on dedicated servers and is unsure how to inventory and patch them quickly, or you want a WAF and monitoring layer in front while you patch, contact Excello Digital at https://excello.digital/contact/. We help organisations across Europe triage, patch and harden their web infrastructure under pressure.