Critical PHP Vulnerabilities Expose Millions of Servers to Remote Code Execution
The PHP Foundation has released urgent security patches for two critical vulnerabilities dubbed "PHP2Shell" that have lurked in the widely used server-side scripting language for over a decade. The flaws, tracked as CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale global state), allow unauthenticated attackers to execute arbitrary code, seize control of servers, and exfiltrate data. Both vulnerabilities carry a CVSS v4 score of 9.2, placing them in the same severity tier as Heartbleed and Log4j.
Scope and Impact
PHP powers 70% of all websites using server-side languages, with an estimated 2.6 million hosts and 55 million web properties running the software. While 65% of installations use PHP 8.x (the only supported versions receiving fixes), 27% still rely on PHP 7 and 8% on PHP 5, both of which are end-of-life and unpatched. The most at-risk configurations include mod_php (Apache), PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, with proof-of-concept exploits already confirmed for mod_php.
Disclosure and Patch Timeline
The vulnerabilities were independently discovered in August 2026 by two research teams leveraging frontier AI models including OpenAI’s GPT-5.6 Sol, Google’s Gemini 4 Argon, and Wiz’s Atlas as part of coordinated vulnerability disclosure efforts. The PHP team began developing fixes on September 21, with a planned embargoed release on October 3 (Thursday). However, after details leaked prematurely on October 1 (Tuesday), PHP accelerated the patch rollout, releasing fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) on October 2 (Wednesday).
Exploitation and Threat Landscape
Cybersecurity firms report active exploitation attempts, though successful breaches remain unconfirmed. Attackers frequently reverse-engineer patches within 24 hours, making immediate updates critical. The Dutch National Cyber Security Centre (NCSC) took its PHP-based website offline as a precaution, while the NSA, CERT-EU, and the UK’s NCSC have all urged organizations to patch or isolate vulnerable systems.
AI’s Role in Vulnerability Discovery
The complexity of these flaws requiring subtle memory-management failures and intricate exploit chains traditionally demanded highly specialized expertise and months of research. However, AI models enabled researchers to identify and weaponize the vulnerabilities in just two months, demonstrating how frontier AI is lowering the barrier for both defenders and attackers. The incident underscores ongoing debates about coordinated disclosure in the AI era, where multiple teams (and potentially malicious actors) may independently uncover the same flaws using similar tools.
Mitigation and Response
Organizations are advised to upgrade to patched PHP versions immediately. For systems unable to update, the NSA recommends taking them offline until mitigations are applied. The PHP Foundation warns that no fixes will be issued for unsupported versions (pre-8.x), leaving legacy installations permanently exposed.
Source: https://www.bankinfosecurity.com/critical-php-patches-address-very-very-bad-vulnerability-a-33162
The PHP Foundation cybersecurity rating report: https://www.rankiteo.com/company/phpfoundation
"id": "PHP1792607143",
"linkid": "phpfoundation",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '2.6 million hosts, 55 million '
'web properties',
'industry': 'Technology/Software Development',
'name': 'PHP Foundation',
'type': 'Software Foundation'},
{'industry': 'Cybersecurity/Government',
'location': 'Netherlands',
'name': 'Dutch National Cyber Security Centre (NCSC)',
'type': 'Government Agency'}],
'attack_vector': ['Unauthenticated Remote Exploitation'],
'data_breach': {'data_exfiltration': 'Possible',
'personally_identifiable_information': 'Potential',
'sensitivity_of_data': 'High (if personally identifiable or '
'payment information is compromised)',
'type_of_data_compromised': ['Potentially sensitive data (if '
'exfiltrated)']},
'date_detected': '2026-08',
'date_publicly_disclosed': '2026-10-01',
'date_resolved': '2026-10-02',
'description': 'The PHP Foundation released urgent security patches for two '
'critical vulnerabilities (CVE-2026-109618 and '
'CVE-2026-109619) in PHP, allowing unauthenticated attackers '
'to execute arbitrary code, seize control of servers, and '
'exfiltrate data. The flaws affect 70% of all websites using '
'server-side languages, with an estimated 2.6 million hosts '
'and 55 million web properties at risk. Active exploitation '
'attempts have been reported, though successful breaches '
'remain unconfirmed.',
'impact': {'brand_reputation_impact': 'Potential reputational damage for '
'organizations running vulnerable PHP '
'versions',
'data_compromised': 'Potential data exfiltration',
'identity_theft_risk': 'Potential if personally identifiable '
'information is compromised',
'operational_impact': 'Potential server compromise and '
'unauthorized access',
'payment_information_risk': 'Potential if payment data is exposed',
'systems_affected': ['Web servers running PHP (mod_php, PHP-FPM, '
'php-cgi, FrankenPHP, LiteSpeed)']},
'investigation_status': 'Ongoing (active exploitation attempts reported, '
'successful breaches unconfirmed)',
'lessons_learned': 'AI models significantly accelerate vulnerability '
'discovery, lowering barriers for both defenders and '
'attackers. Coordinated disclosure processes must adapt to '
'the AI era to prevent premature leaks.',
'post_incident_analysis': {'corrective_actions': ['Accelerated patch '
'development and release',
'Public advisories to '
'encourage immediate '
'updates'],
'root_causes': ['Memory corruption '
'(CVE-2026-109618)',
'Stale global state '
'(CVE-2026-109619)',
'Lack of support for legacy PHP '
'versions (pre-8.x)']},
'recommendations': ['Immediately upgrade to patched PHP versions (8.5.12, '
'8.4.27, 8.3.36, 8.2.35).',
'Isolate or take offline systems running unsupported PHP '
'versions (pre-8.x).',
'Monitor for active exploitation attempts and apply '
'mitigations as advised by cybersecurity agencies.'],
'references': [{'source': 'PHP Foundation Security Advisory'},
{'source': 'Dutch National Cyber Security Centre (NCSC)'},
{'source': 'NSA, CERT-EU, UK NCSC Advisories'}],
'regulatory_compliance': {'regulatory_notifications': ['NSA',
'CERT-EU',
'UK NCSC']},
'response': {'communication_strategy': ['Public advisories from NSA, CERT-EU, '
'UK NCSC, and PHP Foundation'],
'containment_measures': ['Upgrade to patched PHP versions '
'(8.5.12, 8.4.27, 8.3.36, 8.2.35)',
'Isolate or take offline unsupported '
'PHP versions (pre-8.x)'],
'remediation_measures': ['Apply security patches released by PHP '
'Foundation']},
'stakeholder_advisories': 'NSA, CERT-EU, UK NCSC, and PHP Foundation have '
'issued urgent advisories to patch or isolate '
'vulnerable systems.',
'title': 'Critical PHP Vulnerabilities Expose Millions of Servers to Remote '
'Code Execution (PHP2Shell)',
'type': ['Remote Code Execution', 'Memory Corruption', 'Stale Global State'],
'vulnerability_exploited': ['CVE-2026-109618', 'CVE-2026-109619']}