Two critical vulnerabilities in PHP, a programming language used by approximately 70% of websites, have prompted security updates and temporary website shutdowns worldwide. Known as PHP2Shell, the flaws could allow attackers to run malicious code on vulnerable web servers without logging in.
Emergency patches were released on October 21, 2026, while cybersecurity companies reported attempts to exploit the vulnerabilities.
The flaws were uncovered through AI-assisted research involving OpenAI and cybersecurity partners. Researchers reported that the weaknesses had existed for decades but were difficult to exploit.
Following the discovery, government cybersecurity agencies urged organizations to install updates immediately and consider taking vulnerable systems offline until fixes could be applied.
Why It Matters: PHP2Shell shows how vulnerabilities in widely used software can disrupt business operations and require immediate security action. Organizations must identify affected systems and deploy fixes while maintaining service availability. AI’s role in uncovering the flaws also demonstrates how advances in security research are making longstanding vulnerabilities easier to discover, potentially reducing the time available to address them.
- Millions of Websites Could Be Affected: Censys identified nearly 55 million web properties running PHP when the vulnerabilities were disclosed. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect how PHP handles memory and could allow attackers to take control of vulnerable servers without authentication. The number of installations exposed to these attacks remains unknown.
- AI Helped Uncover Vulnerabilities That Had Existed for Decades: OpenAI worked with cybersecurity researchers and PHP maintainers to identify the flaws. According to researchers at Wiz, the weaknesses were difficult to exploit using traditional methods. AI tools helped uncover techniques that made exploitation possible. OpenAI described the discovery as one of the most consequential software security findings in recent memory.
- Attempts to Exploit the Flaws Were Reported Before Public Disclosure: Cloudflare reported millions of exploitation attempts after the vulnerabilities became public. Amazon also identified suspicious activity targeting PHP2Shell on October 17, four days before the announcement. The PHP Foundation separately alleged that Chainguard released patch details ahead of an agreed deadline. It remains unclear how many attacks resulted in successful compromises.
- Some Websites and Government Services Temporarily Went Offline: Cybersecurity agencies in the United States, United Kingdom, European Union, and Japan recommended immediate updates. Websites including Pinboard, 4chan, Something Awful, and portions of Wikipedia temporarily suspended services. Some government websites also experienced interruptions while administrators applied security measures.
- Patches Are Available, but Older Systems May Take Longer to Secure: PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Cloudflare introduced firewall protections, and security researchers made tools available to help identify vulnerable servers. Organizations using older PHP versions may need additional support from software vendors or alternative fixes because those versions are no longer officially maintained.
PHP2Shell: Critical PHP vulnerabilities patched, update now! – Help Net Security
