PHP2Shell vulnerabilities allow unauthenticated remote code execution in PHP, prompting emergency patches, mass attacks and global website shutdowns.

Related: Anthropic’s Claude Mythos Escapes Sandbox in Alarming Cybersecurity Test 2026

---

PHP2Shell Vulnerabilities Trigger Global Cybersecurity Emergency

The PHP2Shell vulnerabilities have triggered one of the most widespread cybersecurity emergencies in recent years, forcing governments, banks, airlines and global platforms to take preventive action.

The flaws are two critical vulnerabilities in PHP, the open-source programming language that supports an estimated 70 percent of websites worldwide.

The PHP Foundation released emergency patches on Wednesday, October 21, after technical details leaked before the planned coordinated disclosure.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on vulnerable web servers without logging in.

The PHP Foundation rated both flaws 9.2 out of 10 on the CVSS scale, placing them in the critical category.

The vulnerabilities affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

Security researchers say successful exploitation could give attackers remote access to a server’s file system, database and sensitive data.

The flaws could also allow attackers to install malicious software, steal credentials and use compromised servers to launch further attacks.

The PHP Foundation urged administrators to update immediately to the patched versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

The organization said PHP 8.1 and earlier versions no longer receive official security updates, although some Linux distributions and long-term support vendors have issued backported fixes.

The emergency response came after researchers discovered the vulnerabilities using artificial intelligence, highlighting a new phase in cybersecurity.

PHP2Shell Vulnerabilities Discovered With AI Support

PHP Foundation | Cybersecurity and Infrastructure Security Agency

The PHP2Shell vulnerabilities were identified through an unusual collaboration between security firms and artificial intelligence systems.

Researchers at the security firm Calif discovered one of the flaws with support from OpenAI’s GPT-5.6 Sol model.

The work was carried out under OpenAI’s “Patch the Planet” initiative, which aims to use advanced AI to identify and help fix security weaknesses in widely used software.

In parallel, cloud security company Wiz, acquired by Google, said it independently identified both vulnerabilities with AI assistance.

The discoveries revealed flaws that had remained hidden in PHP’s code for years. Some reports suggest the weaknesses may have existed for more than a decade.

The PHP Foundation said the vulnerabilities had been known internally since at least 2024, but efforts to fix them had stalled.

The organization said there had been no practical route to exploitation and that proposed solutions carried technical disadvantages.

The foundation acknowledged that the delay was a structural failure, linked to internal decision-making and limited resources.

The situation worsened when technical details leaked on Tuesday, October 20, before the patches were publicly available.

The leak occurred after Chainguard released built images containing the fix ahead of the agreed embargo, allowing attackers to identify changes in the code.

The PHP Foundation responded by releasing emergency updates on Wednesday, October 21, at 14:00 UTC.

The organization urged website operators to update “immediately” and prioritize internet-facing systems.

The National Security Agency, known as the NSA, advised organizations that could not patch immediately to take affected systems offline until they could be fully protected.

Spain’s National Cybersecurity Institute, known as INCIBE, issued a similar warning, urging administrators to update PHP systems or isolate servers exposed to the internet.

Global Websites Shut Down to Prevent Attacks

Cloudflare | National Cybersecurity Institute of Spain

The disclosure of the PHP2Shell vulnerabilities triggered a rapid wave of attack attempts across the internet.

Cloudflare reported that it observed thousands of exploitation attempts in the 10 hours before the public announcement.

After the details became public, the number rose to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions shortly afterward.

The attacks included large-scale scanning, attempts to identify vulnerable systems and tests of exploit code.

Security experts warned that the speed of the activity showed that attackers could identify vulnerable targets at an industrial scale in near real time.

The threat prompted governments and companies to take preventive measures in several countries.

In Japan, Nomura, Mitsubishi UFJ Financial Group, ANA, East Japan Railway and Tokio Marine temporarily suspended some online services.

Reports of disruptions or alerts also emerged in Finland, the Netherlands, Germany, the United Kingdom, France and China.

The Wikimedia Foundation disabled several systems as a precaution. The move affected parts of the infrastructure behind Wikipedia and related projects.

Telecommunications company Orange suspended access to certain PHP-based websites and applications.

South Korea raised its national cybersecurity alert level in response to the threat.

In Spain, INCIBE reported that around 12 percent of public administrations and companies were receiving attack attempts linked to the vulnerabilities.

The Spanish government said there were no confirmed problems in ministerial or state websites.

Despite the scale of the activity, no massive successful intrusion had been publicly confirmed as of Thursday.

Security firms said most of the detected activity consisted of scanning and failed exploitation attempts.

However, experts warned that it was only a matter of time before attackers compromised systems that had not been updated.

The risk is particularly high for small organizations and websites with limited cybersecurity resources.

Many of these systems may remain unpatched for days or weeks, creating a prolonged window of exposure.

Security experts also warned that attackers could exploit public concern to launch phishing campaigns.

Fraudsters may send emails or messages impersonating banks, government agencies or affected platforms to steal passwords, payment details or personal information.

AI Changes the Speed of Cyberattacks

OpenAI | Wiz

The PHP2Shell vulnerabilities demonstrate how artificial intelligence is changing the speed and scale of cybersecurity operations.

AI helped researchers identify, understand and validate complex flaws that had remained hidden for years.

Traditional security audits can take months to examine large codebases. AI tools can analyze patterns, test hypotheses and identify potential weaknesses more quickly.

OpenAI said advanced AI found the vulnerabilities before attackers could exploit them. The company also acknowledged that the same capabilities can be used to create offensive tools.

The dual nature of AI has become a central concern for cybersecurity experts.

The technology can accelerate vulnerability discovery, patch development and threat detection. But it can also lower the cost and time required for malicious actors to develop automated attacks.

The PHP2Shell case shows that the time between discovery, disclosure and exploitation is shrinking.

Attackers were able to analyze leaked technical details and begin testing exploits before many organizations had applied patches.

Security researchers say the challenge for defenders is not only finding a vulnerability but replacing it with a tested and reliable fix.

Organizations must also ensure that their web servers are actually running the patched version of PHP.

The PHP Foundation said the vulnerabilities affect all PHP installations that serve web requests, regardless of the application running on top of them.

That includes websites built with WordPress, Drupal, Joomla, Magento and MediaWiki.

The widespread use of PHP means that a flaw in its core can affect a vast portion of the internet’s infrastructure.

PHP was created for web development and has been used since the early 2000s. It helped enable the interactive web, online stores, social networks and content management systems.

The language remains central to many of the world’s most visited websites and digital services.

Geopolitical Context

The PHP2Shell vulnerabilities have implications beyond technical security because they expose the fragility of global digital infrastructure.

Critical systems often depend on open-source software maintained by small teams, volunteer communities or nonprofit organizations with limited funding.

The PHP Foundation acknowledged that resource constraints contributed to the delay in fixing the flaws.

The incident has renewed debate over how governments and large technology companies should support the maintenance of open-source software.

Many public services, financial institutions, hospitals and private companies rely on software that is free to use but expensive to secure.

The crisis also highlights the geopolitical importance of cybersecurity. Attacks on web infrastructure can disrupt banking, transport, communications, government services and commerce.

The rapid global response reflected the interconnected nature of the internet. A vulnerability in one programming language affected organizations across multiple continents.

The incident could increase pressure for international cooperation on cybersecurity standards, vulnerability disclosure and incident response.

It may also accelerate investment in AI-driven defense systems, as governments and companies seek to identify threats before attackers can exploit them.

For ordinary users, the immediate risk is not to fix PHP themselves but to follow official guidance from the services they use.

Users should change passwords if a platform requests it, enable two-factor authentication where available and avoid suspicious emails or messages related to the crisis.

The PHP2Shell vulnerabilities are a warning that cybersecurity is no longer only a technical issue. It is now a matter of economic stability, public trust and national security.

---

Italian authorities are examining whether foreign interference helped intensify violent protests across the country, as Defence Minister Guido Crosetto warns that social media is being used as an instrument of hybrid warfare. Prime Minister Giorgia Meloni has introduced emergency security measures and deployed additional troops to Milan, while further demonstrations are planned for Saturday, 24 October.

Italy is investigating the possibility that foreign actors, including Russian operatives, helped amplify the violent unrest that swept Milan and other Italian cities on 17–18 October. The inquiry introduces a national security dimension to demonstrations initially driven by rising living costs, dissatisfaction with public services and broader economic grievances.

According to information disclosed about the government’s intelligence inquiries, officials working under Prime Minister Giorgia Meloni have requested assessments of whether foreign provocateurs contributed to the disorder. No public evidence has established that Moscow organised the violence, and Meloni’s office has declined to comment on the reported intelligence discussions.

The developments follow EU Today’s earlier coverage of the Milan disturbances, which documented extensive looting, attacks on police and the detention of hundreds of young people, many of them minors. Since then, Rome has moved beyond emergency consultations, approving legislation that expands police powers and introduces tougher criminal penalties for violent demonstrations.

On Saturday, 24 October, Italian security forces are preparing for another wave of protests, with additional military personnel, drones and specialist police units deployed in several major cities. The immediate question is whether the government can prevent further disorder while establishing how much of the unrest was locally organised and whether foreign information operations influenced its development.

Crosetto warns of hybrid warfare through social media

Defence Minister Guido Crosetto introduced the hybrid warfare argument during a Defence Procurement Forum in Rome on Tuesday, 20 October. In remarks recorded by Italian public broadcaster Rai, he described the disturbances as the culmination of a form of conflict being conducted through TikTok, YouTube and other social media platforms.

Crosetto argued that young Italians were undergoing what he called a form of counter-education outside their families and schools, absorbing political attitudes and values increasingly hostile to democratic institutions. He criticised Western governments for failing to recognise the consequences of this process, although he did not publicly present intelligence establishing Russian responsibility for the riots.

His comments also exposed differences within the governing coalition. Deputy Prime Minister Matteo Salvini questioned suggestions of Russian involvement, arguing that the immediate priority was identifying violent groups and preventing their movement into Milan.

Russian information operations under scrutiny

European investigators have identified activity by established Russia-linked disinformation networks, including Operation Overload and Doppelgänger, which have circulated and amplified material concerning the unrest.

These operations have previously used manipulated content, misleading narratives and coordinated online distribution to influence European audiences. In the present case, investigations into the online amplification of the violence have identified foreign exploitation of the disturbances, rather than proof that foreign governments organised them.

The European Commission has consequently declined to initiate emergency intervention against social media platforms, citing insufficient evidence linking foreign manipulation directly to the organisation of the protests.

France has taken a similarly cautious position. President Emmanuel Macron acknowledged that foreign actors had manipulated information after the violence but said there was no established evidence that they caused the disturbances. French Foreign Minister Jean-Noël Barrot has separately identified hostile narratives originating from Russia, China and Iran.

For European security authorities, the principal investigative question concerns the relationship between genuine domestic grievances and externally coordinated information campaigns. Foreign networks can exploit political divisions without necessarily directing the organisations or individuals involved in street violence.

Meloni introduces tougher security legislation

Meanwhile, Meloni’s government has proceeded with a substantial legislative response. Following cabinet approval on 20 October, Decree-Law No. 190 of 22 October 2026 entered into force on 23 October.

The legislation introduces penalties of two to five years’ imprisonment and fines of €10,000 to €20,000 for specified forms of organised violence during public demonstrations. Those organising or encouraging qualifying violent groups, including through digital communications, face potential prison terms of four to twelve years. It also expands provisions concerning juvenile offenders and preventive policing. The decree must undergo parliamentary consideration within 60 days.

Separately, the Italian Defence Ministry confirmed the deployment of 500 additional soldiers to Milan under Operation Strade Sicure until 31 December. The soldiers will reinforce security around sensitive locations and support existing police operations without acquiring additional judicial policing powers.

New demonstrations test the government’s response

Security arrangements have been intensified ahead of demonstrations scheduled for Saturday, 24 October, in Milan, Rome, Turin, Bologna, Florence and other cities.

According to the latest security preparations, Rome is deploying approximately 1,500 officers, while Milan is preparing a combined police and military presence supported by aerial surveillance.

On Friday, Italian investigators conducted searches targeting approximately 100 people suspected of involvement in the previous weekend’s disturbances, including 51 minors. Authorities are also monitoring online calls for renewed protests, some organised by groups whose leadership and membership remain unclear.

The unrest presents Meloni with two parallel challenges: containing violence and determining whether hostile foreign networks have played a significant role in its escalation. Italy’s investigations may help establish whether the events represent primarily a domestic public-order crisis, the exploitation of existing tensions by foreign actors, or a combination of both.

For Brussels, the outcome could influence future enforcement of the EU’s Digital Services Act and its wider response to foreign information manipulation. For now, the evidence supports concern about Russian amplification of European unrest, but not a definitive conclusion that Moscow orchestrated the riots.