Within 45 minutes of public disclosure, exploitation attempts against PHP servers jumped from thousands to tens of thousands. Two hours later, that number reached the hundreds of thousands. This is not a hypothetical threat scenario, it is what Cloudflare actually observed in real time after the PHP2Shell vulnerability became public knowledge on October 21, 2026.
The PHP2Shell vulnerability is now considered one of the most consequential security disclosures in the history of the web's most widely used server-side language. It does not target a specific application. It targets PHP itself, the engine quietly running behind roughly 70 percent of all websites, including WordPress, Drupal, Joomla, and MediaWiki (the software behind Wikipedia).
Table of Contents
Key Takeaways
- The PHP2Shell vulnerability consists of two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2.
- It affects PHP core code itself, not individual applications, impacting nearly every PHP version released since PHP 5.4.
- Apache with mod_php carries the highest risk; PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are also affected.
- Wiz Research demonstrated unauthenticated, pre-auth remote code execution against WordPress, Drupal, and Joomla container images.
- Immediate patching to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is the only reliable fix; WAF rules are a stopgap, not a solution.
What Is the PHP2Shell Vulnerability
PHP2Shell is the collective name given to two separate but related remote code execution (RCE) vulnerabilities discovered inside the PHP language's own core codebase. They were disclosed and patched on October 21, 2026, after the PHP team pushed emergency updates.
The two flaws are:
| CVE ID | Name | CVSS Score |
|---|---|---|
| CVE-2026-109618 | RCE via OOM corruption | 9.2 |
| CVE-2026-109619 | RCE via stale global state | 9.2 |
Both scores sit near the top of the severity scale, meaning attackers can potentially take full control of a server without needing a username, password, or any prior access.
How the Flaws Work, in Plain Terms
Understanding the technical root cause helps explain why the PHP2Shell vulnerability is so dangerous.
OOM corruption refers to out-of-memory corruption. When a program runs low on memory, it has to make fast decisions about what to clean up and what to keep. CVE-2026-109618 exploits a flaw in that cleanup process. Under specific memory-pressure conditions, PHP can corrupt its own internal memory structures instead of safely failing. An attacker who can trigger this corruption in a controlled way can potentially hijack what the server does next, including running their own code.
Stale global state is a related but distinct problem. PHP keeps track of certain data across requests using internal global variables. CVE-2026-109619 occurs when old, leftover ("stale") values from a previous operation are reused somewhere they should not be. This is conceptually similar to a use-after-free bug, a well-known class of vulnerability where a program keeps using a piece of memory after it has technically been freed or reset. Attackers can manipulate this stale data to redirect program execution.
Neither vulnerability requires a flaw in the website's own code. A perfectly secure WordPress or Drupal installation can still be compromised purely because of how the underlying PHP interpreter processes requests.
Who Discovered It and How
The PHP2Shell vulnerability was uncovered by security firm Wiz Research, working in collaboration with OpenAI and the PHP Foundation. What makes the discovery particularly notable is the method: Wiz used frontier AI models, including Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, to analyze PHP's decades-old codebase and identify the flaws.
This detail has become a central part of the story. The Guardian has labeled the week "Black October," describing it as a turning point where artificial intelligence was used for the first time to discover and demonstrate exploitation of such a deeply embedded, complex vulnerability in legacy code that human researchers had reviewed for years without finding it.
Anthropic's deputy CISO, Jason Clinton, warned of a coming "vulnerability tsunami" as AI-assisted code analysis becomes more capable of finding this class of bug. Salesforce CEO Marc Benioff called the situation a "code red." OpenAI CEO Sam Altman was blunt, telling The Guardian, "we're not going to be able to patch all bugs" anymore, a statement that reframes the entire conversation around software security in the AI era.
Scope: Why 70 Percent of the Web Is Exposed
The PHP2Shell vulnerability is not confined to outdated or poorly maintained installations. Because the flaws exist in PHP's core, Wiz estimates that practically all PHP versions released since PHP 5.4, spanning more than a decade of releases, are affected. Given that PHP powers an estimated 70 percent of all websites globally, the practical exposure is enormous.
Affected deployment modes include:
- Apache with mod_php, flagged by the PHP team as carrying the highest risk
- PHP-FPM
- php-cgi
- FrankenPHP
- LiteSpeed
Wiz's proof-of-concept demonstrations are what turned theoretical risk into a visible emergency. Researchers achieved unauthenticated, pre-auth remote code execution against current Docker container images of WordPress, Drupal, and Joomla, three of the most widely deployed content management systems on the internet. Separately, Wiz demonstrated remote process-memory disclosure, meaning attackers could potentially extract passwords, authentication tokens, and API keys directly from a running server's memory, without ever executing code.
Who Needs to Act Immediately
Operators running any of the following should treat this as an urgent priority, not a routine patch cycle:
- WordPress, Drupal, Joomla, or MediaWiki sites on self-managed servers
- Shared hosting environments running legacy PHP versions
- Docker-based deployments using older or unpatched PHP base images
- Any server using Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed
This is not limited to small businesses or hobbyist sites. Government and private-sector websites in both the US and the UK temporarily took services offline specifically to apply emergency patches, underscoring how seriously enterprise and public-sector IT teams treated the disclosure.
Official Response and Government Warnings
Given the severity, government cybersecurity agencies moved quickly. The US National Security Agency (NSA) issued a warning on October 21 and 23, 2026, urging immediate patching. CISA published its initial advisory on October 21, updating it on October 23 with additional guidance, including a SIGMA detection rule that security teams can use to identify exploitation attempts in log data.
"We're not going to be able to patch all bugs," Sam Altman told The Guardian, a stark admission that reframes expectations around software security going forward.
The scale and speed of real-world exploitation attempts reported by Cloudflare CEO Matthew Prince reinforce why these advisories were issued so rapidly. Attackers began probing for vulnerable servers within hours of disclosure, not days.
How to Fix the PHP2Shell Vulnerability
The PHP team has released patched versions, and updating is the only verified permanent fix. System administrators should upgrade to one of the following versions immediately:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Step-by-Step Action Checklist
- Identify your current PHP version on every server, container, and staging environment.
- Check your deployment mode, confirm whether you're running Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed, since risk levels vary.
- Apply the patched PHP version matching your current major branch (8.5, 8.4, 8.3, or 8.2).
- Rebuild and redeploy Docker images rather than patching live containers, since Wiz specifically demonstrated exploitation against container images.
- Review CISA's SIGMA detection rule and integrate it into your logging and monitoring pipeline.
- Rotate credentials, including API keys, database passwords, and session tokens, if there is any possibility your server was exposed before patching, given the memory-disclosure risk.
Interim Mitigation if Immediate Patching Isn't Possible
For organizations that cannot patch instantly due to compatibility testing or change-control processes, temporary mitigations include:
- Deploying updated Web Application Firewall (WAF) rules from providers such as Cloudflare or Fastly, which can help filter known exploitation patterns
- Restricting direct public access to PHP endpoints where feasible
- Increasing monitoring sensitivity using CISA's published detection signatures
It is worth noting that WAF rules are a stopgap, not a substitute for patching. Given how the flaws reside in PHP's memory-handling internals, sophisticated attackers may find ways around perimeter filtering.
This is not an isolated case of foundational infrastructure code being exposed to critical remote code execution risk. Similar critical RCE flaws were recently also found in Node.js, as detailed in this Node.js Security Update covering the critical Brotli RCE flaw, suggesting that widely trusted runtime environments across the industry are facing renewed scrutiny from both human and AI-assisted security researchers.
Conclusion
The PHP2Shell vulnerability represents a watershed moment for web infrastructure security. Two critical flaws, CVE-2026-109618 and CVE-2026-109619, sitting inside PHP's core for over a decade, demonstrate that even the most battle-tested software can harbor severe, previously undetected risks, and that AI-assisted vulnerability research is now capable of finding them faster than ever before.
For web developers, IT administrators, and system operators, the path forward is clear and time-sensitive. Patch to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 without delay. Rebuild container images rather than patching in place. Apply CISA's SIGMA detection rule and tighten monitoring. Rotate credentials if exposure is suspected. And treat temporary WAF mitigations as a bridge, not a destination.
As Sam Altman's warning suggests, the era of assuming legacy code is "safe because it's old and well-reviewed" may be ending. Teams that act decisively now will be far better positioned for whatever comes next in this unfolding chapter of AI-driven security research.
