PHP2Shell Vulnerability: Zero-Day Flaws Explained

Insightsonindia • October 23, 2026

Context: Two critical PHP2Shell zero-day vulnerabilities reportedly triggered emergency shutdowns and maintenance across major websites and government portals worldwide, raising cybersecurity concerns.

The PHP2Shell :

A collective designation for two severe, high-impact security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the core PHP runtime engine that enable unauthenticated remote attackers to execute malicious code (RCE) or read sensitive server memory without requiring credentials or physical access.

Background and Discovery:

Widespread Web Dependency: PHP (Hypertext Preprocessor) powers roughly 70% of websites with identifiable server-side languages, including WordPress, which supports over 40% of websites globally.

AI-Assisted Discovery: Researchers from Wiz and Calif reportedly identified decade-old PHP vulnerabilities in August 2026 using advanced AI models under the Patch the Planet initiative.

Emergency Security Disclosure: Following an alleged October 20 exploit leak, PHP maintainers released emergency patches on October 21, involving extensive changes across approximately 200 files.

Exposed Vulnerabilities:

Out-of-Memory Execution Flaw (CVE-2026-109618): Excessive memory consumption can interrupt PHP execution, potentially causing corrupted internal memory structures to be processed and enabling malicious code execution.

Stale Global State Vulnerability (CVE-2026-109619): Improper memory cleanup between HTTP requests may expose residual data pointers, allowing attackers to manipulate server execution and compromise application security .

Why It Triggered Global Shutdowns?

Preventive Security Measures: Reported proof-of-concept exploit leaks prompted warnings from cybersecurity agencies, encouraging temporary shutdowns of vulnerable portals until security patches could be installed.

Complex Patch Deployment : PHP operates across diverse hosting environments, Linux distributions and legacy servers, making immediate security updates difficult for organisations with fragmented infrastructure.

Limited Configuration Workarounds: Simple configuration changes reportedly offered insufficient protection, requiring installation of patched PHP versions and restarting affected server processes.

Vulnerabilities could enable server compromise, credential theft , administrative session hijacking and ransomware attacks, threatening government portals and critical digital infrastructure.

Highlights how advanced AI tools can accelerate identification of longstanding software flaws, reducing the time available for vulnerability disclosure, patching and cyber defence.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both vulnerabilities allow unauthenticated remote code execution (RCE) and have a CVSS score of 9.2. The attack vector involves the `session.upload_progress` feature in PHP, which can be manipulated to execute arbitrary code. Patches were released on October 21, 2026, but exploitation attempts continued shortly after the fixes were made public. The vulnerabilities affect multiple PHP versions, including those that are no longer supported. Organizations are urged to apply the patches immediately and review their systems for potential exposure. 187 sources 73

Extracted Entities

PHP2Shell Vulnerability: Zero-Day Flaws Explained

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Industries (1)

Platforms (3)

Vulnerabilities (2)