Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Discovered

What happened

Two critical security vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, were identified in the PHP programming language [1]. These flaws, referred to as PHP2Shell, allow for unauthenticated remote code execution, meaning attackers could potentially gain control over a system without needing a password [2].

Key details regarding the discovery and response include:

• The PHP Foundation released patches for these vulnerabilities on Wednesday [1, 2].
• PHP developers assigned the vulnerabilities a severity rating of 9.2 out of 10 in a Tuesday advisory [1].
• The vulnerabilities exist in every version of PHP dating back approximately 20 years [1].
• Amazon Threat Intelligence reported that hackers attempted to exploit the flaws days before the patches were released; specifically, Amazon’s security team identified a PHP2Shell exploit attempt on October 17th [1].
• Cloudflare CEO Matthew Prince stated the company saw thousands of exploit attempts in the 10 hours before the public announcement, which grew to hundreds of thousands in the following two hours, and reached millions by the following night [1].
• While the bugs were first discovered in 2024, they were not considered exploitable at that time [2].
• Security researchers at Calif used the GPT-5.6 Sol model to identify the exploits [1].
• Ami Luttwak of Wiz described it as the most severe AI vulnerability ever found [1].
• Elizabeth Barron of the PHP Foundation stated that, to their knowledge, there has been no successful attempt at remote code execution [1].

Who is affected

Because PHP is used by an estimated 70 percent of the web, a massive portion of the internet is at risk [1].

Specific entities and platforms mentioned include:

• Major platforms: Wikipedia, WordPress, Drupal, Joomla, MediaWiki, DeviantArt, 4Chan, and Pokémon Home and Pokémon Champions [1, 2].
• Organizations: The Internet Archive, which patched its systems, and various banks, retailers, hospitals, and online stores [1, 2].
• Governments: Some Dutch and Finnish government agencies took their sites offline as a precaution [1].
• Specific services: World Quest and Save My Demonic World, which developers say cannot be updated to patch the exploit due to older technology [1].

Developers and organizations are urged to update their systems immediately. The NSA and the UK’s National Cyber Security Center recommended that organizations take systems offline if an immediate update is not feasible [1].