Millions of websites globally, including government and private platforms, are at high risk after two critical ‘php2shell’ security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered in the open-source PHP programming language. Developers released emergency security updates on Wednesday, October 21, 2026, with immediate patching strongly recommended.These vulnerabilities, rated 9.2 (critical) on CVSS v4.0, could allow hackers to execute malicious code on affected web servers without authentication. AI tools, including Google-owned security firm Wiz and OpenAI’s GPT-5.6 Sol, played a significant role in identifying these flaws.
Widespread Impact and Early Exploitation
According to Wiz Research, approximately 70% of websites worldwide use PHP, indicating the broad potential impact of these vulnerabilities. One security researcher estimates over 1.3 million websites are at risk, while Palo Alto Networks projects more than 22.6 million affected instances.As a precautionary measure, some government websites in Europe and Canada were taken offline. Cloudflare’s Chief Technology Officer has reported initial attacks, suggesting that the vulnerabilities are already being actively exploited.These flaws have existed in the PHP codebase for decades but previously required an exceptionally complex series of steps to demonstrate exploitability. Frontier AI models significantly reduced this barrier, transforming a long-standing vulnerability into an exploitable threat.The PHP project had announced an upcoming security release to address these vulnerabilities on October 20, 2026. However, information about the flaws became public before the scheduled disclosure date.
Urgent Call for Updates and Mitigation
PHP users are strongly encouraged to update immediately. Fixes were released on October 21, 2026, for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations must apply these patches without delay, prioritizing internet-facing systems.Organizations unable to update immediately, or those using unsupported versions like PHP 8.1 or older, should take PHP-based systems offline until patches or updates are available. Web application firewalls can offer some protection until systems are updated. Network defenders are advised to monitor for suspicious activity, such as PHP worker processes launching shells or downloading tools.In Nepal, government websites were temporarily shut down earlier due to a severe cybersecurity vulnerability in the PHP programming language, affecting the delivery of public services. For more details, see our previous report: Nepal government websites temporarily shut down due to global PHP security flaw.Cisco estimates that nearly half of internet-facing instances are too old to receive direct patches, posing an additional challenge. While minimal backports for PHP 7.4, 8.0, and 8.1 have been released, website administrators and hosting providers still need to install updates on their servers.
Unanswered Questions Remain
Official full details on which specific PHP versions are affected have not yet been released, though reports suggest all versions from PHP 5 onwards could be impacted. PHP has also not yet established whether default installations are at risk, what specific settings are required, or if certain operating systems face greater exposure. Conflicting information exists regarding the ease of exploiting these vulnerabilities, though some sources indicate it is relatively simple.
