Two critical security flaws in PHP, a programming language used by much of the web, have prompted an urgent patching effort after researchers demonstrated how attackers could exploit weaknesses deep inside the software.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known collectively as PHP2Shell, could allow attackers to run code on vulnerable servers without logging in. Depending on the access they gain, attackers could steal sensitive information, alter websites or disrupt online services. The PHP development team released security fixes on October 21, 2026.
The discovery also highlights a growing role for artificial intelligence in cybersecurity. Researchers said advanced AI tools helped them uncover and test complex weaknesses that had remained hidden in PHP for years. The same technology can also help attackers adapt exploits more quickly, making rapid patching increasingly important.
How the PHP flaws work
PHP runs on web servers to generate pages, process requests and support applications. It powers widely used platforms such as WordPress, Drupal and Joomla.
The two vulnerabilities involve errors in how PHP manages memory when a request fails.
The first flaw, CVE-2026-109618, involves PHP’s handling of an out-of-memory condition. Under certain circumstances, the software may try to clean up internal data that was not fully initialized. That can corrupt memory and create an opening for an attacker.
The second flaw, CVE-2026-109619, involves internal state that can remain after the memory it depends on has been released. A later request handled by the same worker may then use that outdated state.
In both cases, a failure during one request can leave PHP in an unsafe state. An attacker may then exploit that condition to access process memory or execute code remotely.
These are flaws in PHP itself, not necessarily in the code written by a website owner. As a result, even an application whose own code is secure could remain exposed if it runs a vulnerable PHP version.
AI helped researchers expose the weaknesses
Wiz Research said its team used AI tools to investigate PHP’s memory-management behavior and develop working demonstrations of the vulnerabilities.
The company reported using its own research tools alongside advanced models, including Gemini 4 Argon and GPT-5.6 Sol. It credited AI with helping researchers find the flaws, develop and adapt exploits, analyze failures and verify the fixes.
The findings emerged through a wider effort involving the PHP team, Wiz, Calif and OpenAI. Other technology and security companies also helped prepare customer guidance, detection tools and temporary protections before the vulnerabilities became public.
The significance is not that AI automatically discovers every security flaw. Rather, researchers say it can reduce the time and specialist effort needed to investigate complicated software behavior and test possible exploit paths.
That creates a challenge for defenders. AI can help security teams find and repair vulnerabilities, but it can also help attackers adapt publicly available technical information into working exploits more quickly.
An attack attempt preceded public disclosure
Amazon Threat Intelligence reported that its MadPot honeypot detected a PHP2Shell exploitation attempt on October 17, four days before the vulnerabilities became public.
A honeypot is a system designed to attract and observe suspicious activity. Amazon said the attempt came from an internet address associated with a commercial anonymization network. It suggested the activity may have involved a threat actor, but the source of the attacker’s information remains unclear.
Amazon also observed further attempts around the time the fixes were released on October 21. It said researchers had not established whether the observed attempts would have succeeded against real-world systems.
That distinction matters. Evidence of an attempted exploit does not prove that an attacker successfully compromised a website, stole data or gained control of a server.
However, the activity shows why organizations should not assume a vulnerability becomes dangerous only after public disclosure. Security teams may need to examine earlier logs and investigate suspicious activity that predates the announcement.
How widely is PHP used?
PHP’s reach helps explain the urgency of the response.
W3Techs estimated that PHP was used by 69.3% of websites whose server-side programming language it could identify in its October 2026 statistics. That is the basis for the widely repeated claim that PHP powers roughly 70% of websites. The figure does not cover every website on the internet, and it measures technology use rather than security incidents.
The number does not mean that 70% of websites have been attacked or compromised. Actual exposure depends on the PHP version, how the server is configured, whether the system has been patched and other security controls.
Still, PHP’s use across hosting services and content-management systems means that an underlying flaw can affect many different types of websites. Operators may also rely on hosting providers or software vendors to manage updates, which can complicate the response.
Which versions need updating?
The PHP team released the following fixed versions on October 21:
- PHP 8.5: Update to 8.5.12 or later.
- PHP 8.4: Update to 8.4.27 or later.
- PHP 8.3: Update to 8.3.36 or later.
- PHP 8.2: Update to 8.2.35 or later.
Operators should obtain updates through the official PHP distribution or their operating-system and hosting vendors. Some Linux distributions and long-term-support providers may issue their own packages with the security fixes applied. Administrators should confirm that the package they install contains the relevant patches.
PHP 8.1 and older branches no longer receive security updates directly from the PHP project. Some vendors may provide backported fixes, but operators should confirm their status with the relevant provider and plan to move to a supported version.
PHP 8.2 is also approaching the end of its support period. The project says that branch reaches end of life on December 31, 2026, so operators should plan their longer-term upgrade rather than rely indefinitely on its current fixed release.
Why temporary protection is not enough
A web application firewall, or WAF, can help block suspicious requests. Other temporary measures can also reduce exposure while administrators prepare and test an update.
But these controls are not a complete substitute for installing the security fixes. The vulnerabilities affect PHP’s underlying runtime, and the PHP team says updating is the only complete remediation. Amazon and national cybersecurity guidance also urge organizations to patch promptly.
Organizations that cannot patch immediately should follow the official guidance for their environment. Depending on the system and the available protections, that may include applying temporary mitigations, restricting exposed functionality or taking a vulnerable service offline until it can be secured.
Administrators should also review logs for suspicious activity and investigate possible signs of compromise. Installing an update prevents continued exposure to the known flaws, but it does not automatically establish whether an attacker accessed a system before the fix.
What website operators and users should know
Website owners and hosting providers should identify every system running PHP, prioritize internet-facing servers and confirm that the appropriate security update has been installed. They should also check software and services that bundle PHP, rather than focusing only on applications that advertise it directly.
Ordinary visitors do not need to stop visiting every website that uses PHP. The widespread use of the language does not mean every PHP-powered site is compromised. The immediate responsibility lies with the organizations that operate and maintain affected systems.
The PHP2Shell disclosures show how a flaw deep in a widely used technology can create a broad security challenge. They also illustrate a dual effect of AI-assisted research: it can help defenders uncover longstanding weaknesses, but it may shorten the time attackers need to turn technical knowledge into an attempted intrusion.
For website operators, the immediate priority is clear: install the appropriate security update, verify that it is active, and investigate any evidence of suspicious activity.
Reporting Credit: PHP development team — official security advisory and release announcements identifying CVE-2026-109618 and CVE-2026-109619 and listing fixed versions. Wiz Research — technical report describing the vulnerabilities, AI-assisted research and disclosure coordination. Amazon Threat Intelligence — October 21, 2026, account of PHP2Shell exploitation attempts observed before and after public disclosure. UK National Cyber Security Centre — official guidance on affected systems and remediation.
