Two critical vulnerabilities in the widely used PHP programming language have triggered a global cybersecurity alert, prompting companies and website operators to patch vulnerable systems amid reports that attackers began exploiting the flaws before public disclosure.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, could allow remote attackers to execute malicious code on affected systems without requiring a password or other authentication, according to a report published by TechCrunch on October 24.
The PHP Foundation, which maintains the open-source programming language, released security patches on Wednesday, October 21, following coordinated efforts to address the flaws and give major technology companies and web hosting providers time to prepare updates.
Despite those efforts, security researchers warned that many systems remained unpatched and vulnerable to potential intrusions and data theft.
Why the PHP vulnerabilities are serious
PHP is widely used to build websites and web applications, including platforms and content management systems such as WordPress, Drupal and Joomla.
The vulnerabilities are particularly concerning because they reportedly allow remote code execution, a category of security flaw that can enable an attacker to run unauthorised commands on a compromised system.
If successfully exploited, such access could allow attackers to install malware, steal sensitive information or maintain access to a network.
TechCrunch reported that PHP is used across a substantial portion of the web, citing an estimate of around 70% of web-facing internet infrastructure. However, the prevalence of PHP does not mean every website using the language is vulnerable; exposure depends on the affected components, configurations and whether security updates have been applied.
The flaws were initially discovered in 2024 but were not considered exploitable at the time, according to the report. Researchers subsequently developed methods to exploit them and alerted the PHP Foundation.
Researchers report exploitation before patches
The incident has raised concerns whether attackers obtained information the vulnerabilities before the patches were publicly released.
Amazon reportedly detected exploitation attempts around a week before the security fixes became available and advised defenders to look for possible evidence of activity dating back to October 17.
The source of the attackers’ knowledge remained unclear. Possible explanations included independent discovery, a leak of confidential information or the early availability of patch details.
Cloudflare chief executive Matthew Prince also said the company had observed a sharp increase in attempts to exploit the flaws following their disclosure.
While the response helped limit the immediate risk of widespread exploitation, security experts warned that vulnerable systems could remain exposed as organisations work through updates and investigate potential compromises.
AI-assisted research helped uncover the flaws
The vulnerabilities were discovered by researchers at Calif during a security audit of PHP code, according to TechCrunch.
Calif was participating in Hack the Planet, an initiative involving AI model maker OpenAI and cloud security company Wiz. The report said AI tools assisted the researchers, while their existing knowledge of PHP's codebase and exploitation techniques remained central to the work.
The case has renewed debate how AI could change cybersecurity. Such tools may help researchers identify weaknesses more quickly, but they could also help malicious actors analyse software flaws and develop attacks.
Researchers cautioned that AI cannot automatically discover every vulnerability through simple prompts and that substantial technical expertise may still be required to turn a potential flaw into a working exploit.
Legacy software remains a long-term security challenge
The PHP incident highlights the risks associated with widely deployed software that has been maintained for decades and is embedded in websites, developer tools and other technology products.
PHP is not limited to conventional websites. It can also be part of software environments and components that organisations depend on, meaning updates may be needed across multiple products and systems.
Smaller organisations and developers may take longer to apply patches, while older systems may no longer receive updates. These factors could prolong the risk even after security fixes become available.
The incident also underscores a broader challenge for open-source software: projects maintained by relatively small teams can underpin services used by millions of people and businesses worldwide.
Although the immediate response appears to have prevented the worst-case scenario described in the report, the full impact of PHP2Shell may take time to establish.
Pakistan, Türkiye, Saudi Arabia, Egypt condemn Houthi attacks, back Riyadh
Lahore sexual assault: Azerbaijan woman calls suspect innocent, seeks case closure
IHC orders immediate pension, benefits for employee after decades
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
