Decade-old Critical PHP2Shell Bugs Put 70% Websites at Risk

If you have a website, there is a seven in ten chance that you are affected by the critical vulnerabilities discovered in PHP – the general-purpose scripting language that silently powers 70% of all websites on the internet.

On 21 October 2026, PHP released patches in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing two critical vulnerabilities which allow attackers to achieve RCE (remote code execution).

The severity of the flaws are critical, with a 9.2 CVSS (Common Vulnerability Scoring System) score and confirmed exploitation in the wild.

Amazon Threat Intelligence identified exploitation attempts in the company’s MadPot telemetry on 17 October 2026 – a whole four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.

Stable production code ‘that just works’ is now at risk due to the speed and volume of new vulnerabilities found via AI-driven discovery Gunnar Hellekson, Vice President and General Manager, Lightwell at Red Hat

Stable production code ‘that just works’ is now at risk due to the speed and volume of new vulnerabilities found via AI-driven discovery

Cloudflare has also identified exploitation and is part of a coordinated effort to deploy mitigations which include working with the PHP Foundation , OpenAI and Wiz .

Cloudflare deployed web application firewall (WAF) protections, which came into operation nine hours before the disclosure, protecting both the free and paid users against PHP2Shell.

What is the PHP2Shell family of vulnerabilities?

Vulnerabilities where attackers exploit PHP to execute malicious code, usually using a command interpreter like Windows PowerShell or Linux bash (commonly known as a shell) are classified as PHP2Shell.

The name suggests a path from PHP to a shell, or in other words, PHP-to-shell.

The vulnerabilities affect all web servers that run PHP 5.4 or later and may allow an attacker to cause denial of service (DoS), RCE and also expose sensitive data.

These two flaws involve errors in memory handling and threatens websites running affected versions of PHP, including WordPress, Drupal and Joomla.

“Much of the critical software running the world is also the least visible,” notes Gunnar Hellekson, Vice President and General Manager, Lightwell at Red Hat .

“Stable production code ‘that just works’ is now at risk due to the speed and volume of new vulnerabilities found via AI-driven discovery. The issues facing PHP are a reminder of just how deeply open source is woven into the systems that run global business.

“Given the potential impact of these vulnerabilities, Red Hat recommends that customers deploy validated, tested patches as soon as they are available from trusted sources, even outside of normal patching windows.”

How was the critical PHP vulnerability identified?

Cloudflare’s announcement credits Calif.io , Wiz, OpenAI and Quarkslab with disclosing the PHP2Shell vulnerabilities.

OpenAI has been working with open-source maintainers as part of its Patch the Planet initiative .

This gave the offensive security and penetration testing company Calif access to GPT-5.6 Sol, which was used to identify these flaws.

Calif identified the critical flaws, along with Wiz, which independently reported both vulnerabilities.

“The bug has been present in PHP for 14 years, and a limited version of it had been discovered in 2024 and wasn't considered significant at the time,” OpenAI’s President, Greg Brockman writes on X.

“Security researchers at Calif, operating as part of Patch the Planet, used GPT-5.6 Sol to find a version of this bug in August; our team found a more complete version independently in September.

“Our team put a huge amount of work into preparing the world to mitigate the impacts of this vulnerability , including working closely with [the] government and partners including PHP, Wiz and Cloudflare.”

The AI paradox, embargo and how should organisations respond to PHP2Shell?

When such critical vulnerabilities are identified, there is a process of embargo which allows defenders crucial time to fix the flaws before they are released to the public and attackers can create exploits.

But with evidence of early exploitation, Amazon is right to point out: “An embargo protects defenders only until someone else finds the same bug.”

While the company agrees that such coordinated disclosure “is still the right model”, it warns that public disclosure is no longer the “earliest date of exploitation”.

“There’s an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control,” says Raghu Nandakumara, VP of Industry Strategy at Illumio .

“The faster AI becomes at finding weaknesses, the more important it becomes to think what happens after those weaknesses are exposed, especially when organisations can’t immediately patch every affected system.

“It’s that speed without control creates a new kind of security problem.”

“The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running,” Don Smith,Vice President of Threat Intelligence at the Sophos Counter Threat Unit points to a practical implementation problem.

“The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it.

“Security teams should prioritise internet-facing systems, confirming which versions are affected as soon as the official advisory is published, and apply the updates without delay.

“And in line with the advice from NCSC (National Cyber Security Centre), any vulnerable system that cannot be patched should be isolated from the internet until it can be secured.

“Threat actors move fast, especially with the help of AI and this will likely be a priority target for them over the coming hours and days so it is crucial organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold.”

The PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are two critical PHP flaws that allow attackers to achieve remote code execution (RCE)

PHP released patches on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35

Both flaws carry a 9.2 Common Vulnerability Scoring System (CVSS) rating, and exploitation by attackers has been confirmed

Amazon Threat Intelligence detected exploitation attempts on 17 October 2026, four days before public disclosure, while Cloudflare deployed web application firewall (WAF) protections nine hours before disclosure

OpenAI President Greg Brockman says the bug had been present in PHP for 14 years, and Calif used GPT-5.6 Sol to find a version of it

Sophos Counter Threat Unit Vice President of Threat Intelligence Don Smith advises prioritising internet-facing systems and isolating any vulnerable system that cannot be patched

National Cyber Security Centre

National Cyber Security Centre

Don Smith Vice President Threat Research

Vice President Threat Research

Greg Brockman President, Chairman, & Co-Founder

President, Chairman, & Co-Founder

Gunnar Hellekson Vice President and General Manager, Lightwell

Vice President and General Manager, Lightwell

Raghu Nandakumara Vice President, Industry Strategy

Vice President, Industry Strategy

National Cyber Security Centre

National Cyber Security Centre

The Top 100 Cyber Leaders 2026 is Out Now! Cyber Security

What we Know Proofpoint's US$6.3bn Varonis Acquisition Cyber Security

Why is Cohere Acquiring Agentic AI Cybersecurity firm AISLE? Technology & AI

ISACA CEO on Turning AI Adoption into Accountability & Trust Cyber Security