Here’s what happened this week: PHP, the scripting language behind roughly 70 percent of websites, got emergency patches for two critical flaws, and by then someone had already tried to use them. Amazon says the first attempt it saw came four days before the fix existed.
Old Bugs, New Tools
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “php2shell.” Wiz Research found them. Both are memory-safety failures in the core engine, in how PHP handles fatal errors such as running out of memory. A corrupted internal state can survive a crashed request, and a later request can reuse it. The result is memory disclosure or unauthenticated remote code execution, and it doesn’t matter how well the website’s own code is written. In plain terms, an attacker can take over a server, read passwords and API keys out of its memory, or deface a site without ever touching the site’s code.
Every PHP version since 5.4 is affected. The bugs themselves are more than a decade old. What kept them quiet was the effort needed to exploit them, which Wiz describes as sitting at the edge of what human researchers could manage. Frontier AI models changed that, the company says, and a single researcher finished in a week what would once have taken a strong team months.
Think of it like a lock that was always pickable in theory, but only by someone willing to spend months building the right tools. Now the tools can be built in hours.
Patches Land After the Attempts
PHP shipped fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both flaws score 9.2 on the CVSS v4.0 scale. The announcement left no room for hedging: “There are no complete mitigations; updating is the only safe choice.”
Attackers got there first. Amazon Threat Intelligence spotted an attempt in its MadPot telemetry dated October 17, coming from an address tied to a commercial anonymization network. Amazon told customers to check logs from that date forward. Cloudflare had web application firewall rules live at 03:02 UTC on October 21, about nine hours before the release.
A Disclosure That Came Apart
The quiet coordination that normally precedes a patch fell apart. The PHP Foundation says CVE identifiers started circulating two days early, a researcher mistakenly published a video of a proof of concept, and Chainguard broke the embargo by publishing container images that already contained the fix. Chainguard’s policy, updated a month earlier, lets it shorten disclosure timelines when a flaw is under active exploitation.
The Foundation’s verdict: “any attacker could now study the fix in binary form while every other PHP user was still waiting for the release.” Step-by-step instructions for the exploit reportedly spread on social media. One commenter on r/selfhosted switched off Apache and took every site offline rather than sit through another five or six hours before the hotfix. The Dutch national cyber security centre and the Dutch House of Representatives pulled their own websites as a precaution.
Am I Even Running PHP?
Whether you’re exposed depends on how PHP is served. Apache mod_php has confirmed remote code execution for both flaws, validated over HTTP with default input and memory limits. For PHP-FPM, the session case was validated, but the advisory says no complete FPM exploit has been shown for the out-of-memory bug. FrankenPHP is described as likely vulnerable based on source analysis alone.
For many administrators the first problem was finding out. Commenters turned up PHP inside OPNsense firewalls, OpenMediaVault storage boxes, Nextcloud and Coolify. For a lot of homelab and embedded gear, one said, nobody knows what language is running underneath. That is the practical upshot: shared hosting, container stacks and appliances all need patching on different schedules, and some owners won’t realize they need to at all.
Not the First Wake-Up Call
Wiz Research compares php2shell to Heartbleed in 2014 and Log4Shell in 2021. Heartbleed exposed how fragile shared security infrastructure can be. Log4Shell showed how deeply buried dependencies can leave organizations unable to say what they are running. Wiz argues this one is a turning point for the AI era, because AI changed how practical it is to exploit old weaknesses.
The same engine sits under WordPress, Drupal, Joomla and MediaWiki, which is why the exposure is so broad. Wiz demonstrated unauthenticated remote code execution against the latest container images of WordPress, Drupal and Joomla. And a third issue, CVE-2026-115560, is still unpatched. PHP advises setting session.upload_progress.enabled=0 until the next bugfix release.
Sources
- PHP
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
- PHP Patches Two Critical RCE Flaws That Were Already Under Attack
Photo: The National Archives (UK) (CC BY 3.0)
