Critical PHP2Shell Vulnerabilities Discovered and Exploited by Hackers

What happened

The PHP Foundation released emergency security updates on Wednesday, October 22, 2026, to fix two critical vulnerabilities known collectively as PHP2Shell. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, received a critical score of 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS) [3].

Research from Amazon Web Services (AWS) indicates that exploitation attempts began as early as October 17, four days before the public disclosure [1]. AWS analysts detected these attempts on a honeypot from an IP address linked to a commercial anonymization network or VPN [1]. CJ Moses, AWS’s chief information security officer, stated that while the vulnerability was under embargo, the targeting suggests a threat actor was involved, though it is unclear how they obtained the information [1].

Both OpenAI and the Wiz team discovered the flaws using AI tools. OpenAI used GPT-5.6 Sol through its “Patch the Planet” initiative with security company Calif [2]. Wiz used its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to find multiple vulnerabilities [2]. Both groups followed responsible research practices by working with the PHP Foundation on patches before the public announcement [2].

Who is affected

The vulnerabilities impact all PHP installations serving web requests, dating back to PHP version 5 released in July 2004 [3]. Because PHP powers approximately 70% of the internet, including over 33 million sites and systems like WordPress, Drupal, and Magento, the potential impact is vast [2, 3].

Specific details regarding the impact include:

• Unauthenticated attackers can execute code on affected servers or read sensitive process memory, which may contain passwords, API keys, and certificates [3].
• Only PHP 8.2 and newer versions are currently supported and will receive these patches; PHP 8.1 and older are no longer supported [2, 3].
• The recommended secure version is PHP 8.5.12 [2].
• Some organizations have already taken websites offline to prevent attacks, including the Finnish National Land Survey, various French government websites, and the Port of Rotterdam [3].

What students should do next

Security experts and agencies have provided specific guidance for those managing web systems:

• The PHP Foundation states that updating is the only safe choice as there are no complete mitigations [3].
• The U.S. National Security Agency (NSA) warns that if a website cannot be patched immediately, it should be pulled offline [2].
• The UK’s National Cyber Security Center (NCSC) advises organizations to identify all systems running PHP and prepare for immediate updating [3].
• The EU’s Computer Emergency Response Team (EU-CERT) and Australia’s cybersecurity agency also advised IT teams to prepare for immediate updates [3].