PHP2Shell vulnerabilities allow unauthenticated remote code execution in PHP, prompting emergency patches, mass attacks and global website shutdowns.
Related: Anthropic’s Claude Mythos Escapes Sandbox in Alarming Cybersecurity Test 2026
PHP2Shell Vulnerabilities Trigger Global Cybersecurity Emergency
The PHP2Shell vulnerabilities have triggered one of the most widespread cybersecurity emergencies in recent years, forcing governments, banks, airlines and global platforms to take preventive action.
The flaws are two critical vulnerabilities in PHP, the open-source programming language that supports an estimated 70 percent of websites worldwide.
The PHP Foundation released emergency patches on Wednesday, October 21, after technical details leaked before the planned coordinated disclosure.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on vulnerable web servers without logging in.
The PHP Foundation rated both flaws 9.2 out of 10 on the CVSS scale, placing them in the critical category.
The vulnerabilities affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Security researchers say successful exploitation could give attackers remote access to a server’s file system, database and sensitive data.
The flaws could also allow attackers to install malicious software, steal credentials and use compromised servers to launch further attacks.
The PHP Foundation urged administrators to update immediately to the patched versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
The organization said PHP 8.1 and earlier versions no longer receive official security updates, although some Linux distributions and long-term support vendors have issued backported fixes.
The emergency response came after researchers discovered the vulnerabilities using artificial intelligence, highlighting a new phase in cybersecurity.
PHP2Shell Vulnerabilities Discovered With AI Support
PHP Foundation | Cybersecurity and Infrastructure Security Agency
The PHP2Shell vulnerabilities were identified through an unusual collaboration between security firms and artificial intelligence systems.
Researchers at the security firm Calif discovered one of the flaws with support from OpenAI’s GPT-5.6 Sol model.
The work was carried out under OpenAI’s “Patch the Planet” initiative, which aims to use advanced AI to identify and help fix security weaknesses in widely used software.
In parallel, cloud security company Wiz, acquired by Google, said it independently identified both vulnerabilities with AI assistance.
The discoveries revealed flaws that had remained hidden in PHP’s code for years. Some reports suggest the weaknesses may have existed for more than a decade.
The PHP Foundation said the vulnerabilities had been known internally since at least 2024, but efforts to fix them had stalled.
The organization said there had been no practical route to exploitation and that proposed solutions carried technical disadvantages.
The foundation acknowledged that the delay was a structural failure, linked to internal decision-making and limited resources.
The situation worsened when technical details leaked on Tuesday, October 20, before the patches were publicly available.
The leak occurred after Chainguard released built images containing the fix ahead of the agreed embargo, allowing attackers to identify changes in the code.
The PHP Foundation responded by releasing emergency updates on Wednesday, October 21, at 14:00 UTC.
The organization urged website operators to update “immediately” and prioritize internet-facing systems.
The National Security Agency, known as the NSA, advised organizations that could not patch immediately to take affected systems offline until they could be fully protected.
Spain’s National Cybersecurity Institute, known as INCIBE, issued a similar warning, urging administrators to update PHP systems or isolate servers exposed to the internet.
Global Websites Shut Down to Prevent Attacks
Cloudflare | National Cybersecurity Institute of Spain
The disclosure of the PHP2Shell vulnerabilities triggered a rapid wave of attack attempts across the internet.
Cloudflare reported that it observed thousands of exploitation attempts in the 10 hours before the public announcement.
After the details became public, the number rose to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions shortly afterward.
The attacks included large-scale scanning, attempts to identify vulnerable systems and tests of exploit code.
Security experts warned that the speed of the activity showed that attackers could identify vulnerable targets at an industrial scale in near real time.
The threat prompted governments and companies to take preventive measures in several countries.
In Japan, Nomura, Mitsubishi UFJ Financial Group, ANA, East Japan Railway and Tokio Marine temporarily suspended some online services.
Reports of disruptions or alerts also emerged in Finland, the Netherlands, Germany, the United Kingdom, France and China.
The Wikimedia Foundation disabled several systems as a precaution. The move affected parts of the infrastructure behind Wikipedia and related projects.
Telecommunications company Orange suspended access to certain PHP-based websites and applications.
South Korea raised its national cybersecurity alert level in response to the threat.
In Spain, INCIBE reported that around 12 percent of public administrations and companies were receiving attack attempts linked to the vulnerabilities.
The Spanish government said there were no confirmed problems in ministerial or state websites.
Despite the scale of the activity, no massive successful intrusion had been publicly confirmed as of Thursday.
Security firms said most of the detected activity consisted of scanning and failed exploitation attempts.
However, experts warned that it was only a matter of time before attackers compromised systems that had not been updated.
The risk is particularly high for small organizations and websites with limited cybersecurity resources.
Many of these systems may remain unpatched for days or weeks, creating a prolonged window of exposure.
Security experts also warned that attackers could exploit public concern to launch phishing campaigns.
Fraudsters may send emails or messages impersonating banks, government agencies or affected platforms to steal passwords, payment details or personal information.
AI Changes the Speed of Cyberattacks
OpenAI | Wiz
The PHP2Shell vulnerabilities demonstrate how artificial intelligence is changing the speed and scale of cybersecurity operations.
AI helped researchers identify, understand and validate complex flaws that had remained hidden for years.
Traditional security audits can take months to examine large codebases. AI tools can analyze patterns, test hypotheses and identify potential weaknesses more quickly.
OpenAI said advanced AI found the vulnerabilities before attackers could exploit them. The company also acknowledged that the same capabilities can be used to create offensive tools.
The dual nature of AI has become a central concern for cybersecurity experts.
The technology can accelerate vulnerability discovery, patch development and threat detection. But it can also lower the cost and time required for malicious actors to develop automated attacks.
The PHP2Shell case shows that the time between discovery, disclosure and exploitation is shrinking.
Attackers were able to analyze leaked technical details and begin testing exploits before many organizations had applied patches.
Security researchers say the challenge for defenders is not only finding a vulnerability but replacing it with a tested and reliable fix.
Organizations must also ensure that their web servers are actually running the patched version of PHP.
The PHP Foundation said the vulnerabilities affect all PHP installations that serve web requests, regardless of the application running on top of them.
That includes websites built with WordPress, Drupal, Joomla, Magento and MediaWiki.
The widespread use of PHP means that a flaw in its core can affect a vast portion of the internet’s infrastructure.
PHP was created for web development and has been used since the early 2000s. It helped enable the interactive web, online stores, social networks and content management systems.
The language remains central to many of the world’s most visited websites and digital services.
Geopolitical Context
The PHP2Shell vulnerabilities have implications beyond technical security because they expose the fragility of global digital infrastructure.
Critical systems often depend on open-source software maintained by small teams, volunteer communities or nonprofit organizations with limited funding.
The PHP Foundation acknowledged that resource constraints contributed to the delay in fixing the flaws.
The incident has renewed debate over how governments and large technology companies should support the maintenance of open-source software.
Many public services, financial institutions, hospitals and private companies rely on software that is free to use but expensive to secure.
The crisis also highlights the geopolitical importance of cybersecurity. Attacks on web infrastructure can disrupt banking, transport, communications, government services and commerce.
The rapid global response reflected the interconnected nature of the internet. A vulnerability in one programming language affected organizations across multiple continents.
The incident could increase pressure for international cooperation on cybersecurity standards, vulnerability disclosure and incident response.
It may also accelerate investment in AI-driven defense systems, as governments and companies seek to identify threats before attackers can exploit them.
For ordinary users, the immediate risk is not to fix PHP themselves but to follow official guidance from the services they use.
Users should change passwords if a platform requests it, enable two-factor authentication where available and avoid suspicious emails or messages related to the crisis.
The PHP2Shell vulnerabilities are a warning that cybersecurity is no longer only a technical issue. It is now a matter of economic stability, public trust and national security.
Login
