On October 21, 2026, PHP developers released urgent security updates for two critical flaws. Attackers could exploit these weaknesses to run malicious code on affected web servers without logging in.

The disclosure prompted warnings from cybersecurity agencies around the world. They urged organizations to update vulnerable systems or take exposed websites offline until they could secure them.

Researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619. Together, they became known as PHP2Shell.

The threat reached far beyond individual websites. PHP powers websites, online stores and other internet services. A serious flaw in PHP can therefore put many different platforms at risk.

European cybersecurity agencies called for urgent action. CERT-EU advised organizations to install the fixes and consider disconnecting exposed applications that they could not secure quickly.

The incident also revealed a growing challenge: AI can help researchers uncover software flaws that have remained hidden for years.

However, AI did not create these vulnerabilities. Nor did the disclosure prove that attackers had compromised every affected website. The danger came from the flaws themselves, PHP’s widespread use and the difficulty of updating so many systems.

Why a PHP flaw can affect millions of websites

PHP is a programming language that helps websites respond to visitors and display changing content. Developers use it for news sites, online stores, government services and business applications.

Its long history has helped it become a major part of the internet. Many organizations still rely on software built years ago, even when its original developers have moved on.

Reuters, citing web-technology data, reported that PHP runs on nearly 70% of websites with an identifiable server-side programming language. WordPress, one of the world’s most widely used publishing platforms, also relies on PHP.

That figure shows how widely the technology is used. It does not mean that 70% of websites were vulnerable to PHP2Shell.

The key issue is that many different websites can rely on the same PHP software.

A website might use WordPress, Drupal, Joomla, Laravel or a custom-built application. Yet the server may use PHP to run that software. If PHP contains a serious flaw, different websites can face the same underlying risk.

Updating a website’s theme or plugin will not necessarily fix a flaw in PHP itself. Website owners and hosting providers must check the PHP version running their systems and install the correct security update.

This shared dependence turned two software flaws into a wider security concern.

What the two PHP vulnerabilities do

The two flaws involve problems with how PHP handles computer memory and information used to process web requests.

The first flaw, CVE-2026-109618, affects PHP’s response when a program runs out of memory.

PHP uses memory limits to stop requests from consuming too many computer resources. But under certain conditions, an error can interrupt the process before PHP has fully prepared its internal data.

When PHP tries to clean up afterward, it may handle invalid data as if it were valid. That mistake can damage memory and potentially allow an attacker to run malicious code.

The second flaw, CVE-2026-109619, involves information that PHP keeps between stages of processing.

In some circumstances, PHP can retain a reference to information after the memory holding it has been released. A later request handled by the same worker may encounter that outdated reference before PHP resets it.

This can create another path to exploitation.

Both vulnerabilities received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System. That places them in the critical category. PHP developers urged users to address the flaws urgently.

If an attacker successfully exploits a vulnerable server, they may be able to run commands with the permissions available to PHP. Depending on the system, this could expose private information, allow unauthorized changes or help the attacker break into other systems.

The exact damage depends on the server’s security settings and the attacker’s level of access. A vulnerable website is not automatically a compromised website. However, the flaws create a serious risk that administrators should not ignore.

Why developers did not fix the flaws sooner

The history of PHP2Shell shows why fixing a software flaw can take years, even when developers know something may be wrong.

The PHP Foundation said an external security audit raised concerns about the underlying memory problem in 2024. Developers explored possible fixes, but each option brought its own risks.

Some changes could break older applications or third-party extensions. Others raised concerns about denial-of-service attacks, in which attackers overwhelm a system and make it unavailable.

At that stage, the team had also not demonstrated how the suspected flaw could lead to remote code execution.

The foundation later acknowledged that the work stalled and restarted over several months. It pointed to problems in the team’s decision-making and a lack of resources.

This was not simply a case of developers ignoring an obvious security problem. They faced a difficult technical issue without a clear solution or a proven attack path.

That distinction matters. Finding a possible flaw is only the beginning. Developers must understand how it works, determine how attackers might exploit it, build a reliable fix and test that fix without breaking existing software.

The process becomes harder when a small team maintains software used by millions of people and organizations.

PHP2Shell exposed both a technical weakness and a problem with the process used to manage it. The warning existed earlier, but developers needed stronger evidence to understand the full danger and respond effectively.

How AI helped researchers uncover the danger

AI helped researchers examine PHP’s code and investigate how its internal weaknesses could lead to attacks.

According to the PHP Foundation, researchers at Calif reported a remote-code-execution finding on August 11, 2026. The finding shared the underlying cause of the earlier memory problem.

OpenAI later reported related findings, while Wiz independently identified vulnerabilities and additional ways to exploit them. Other researchers also examined PHP during wider security reviews.

OpenAI said Calif used its models as part of its Patch the Planet initiative. Wiz conducted its own research, while Google Cloud described how its Gemini models supported vulnerability discovery, exploit development, attack detection and patch testing.

These efforts involved researchers, AI tools and security teams. The findings did not come from one AI system working entirely on its own.

AI can help security researchers examine large amounts of code, explore unusual ways a program might behave and test ideas about possible weaknesses.

Researchers can use these tools to identify suspicious code, suggest tests, examine errors and investigate whether a flaw could give an attacker control over a system.

This can speed up the path from spotting a problem to proving that it presents a real security threat.

But AI has limits. A model may suggest a flaw that does not exist or produce an exploit that fails in practice. Researchers must test the results, confirm the findings and determine the actual level of risk.

The PHP Foundation also reported a growing number of security findings as AI-assisted research expanded. It said human teams remained responsible for decisions and patches, while AI tools helped validate reports and group findings with shared causes.

The lesson is clear: AI can help researchers work faster, but experienced security professionals still need to verify the results and decide what to do next.

Why fixing the flaws became an urgent race

Discovering a vulnerability does not protect the systems that contain it. Developers must release a fix, and organizations must install it.

After confirming the PHP flaws, developers prepared updates for supported versions of the software.

On October 21, PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project urged users to update immediately. Organizations using older versions needed to check with their software distributor or support provider for an appropriate fix.

Updating thousands of websites is not always simple.

Some businesses use old applications that may stop working after a software upgrade. Others rely on hosting providers to manage PHP for them. Large organizations may also have forgotten servers or outdated websites that no one actively maintains.

These problems can delay security updates, leaving vulnerable systems exposed for longer.

Cloudflare said it deployed web-application firewall protections before public disclosure and observed attack traffic targeting customers around the disclosure period. The company stressed that these protections added a layer of defense but did not replace the need to update PHP.

The disclosure process also faced a setback. The PHP Foundation said information about the vulnerabilities began circulating before the planned release. Developers moved up their announcement and security updates, leaving organizations less time to prepare than expected.

The incident shows why security updates require coordination. Software developers, hosting companies, security researchers and website owners all have a role in reducing the risk.

A fix can protect a system only after the people responsible for that system install it and confirm that it works.

Why governments and businesses responded

A successful attack on a web server can cause more than a damaged website.

Attackers may gain access to customer information, login details, security tokens or other sensitive data. They may also use a compromised server to reach other systems connected to the same network.

For government agencies, an attack could disrupt public services or threaten sensitive information. For businesses, it could expose customer data, interrupt operations or lead to further attacks.

European cybersecurity agencies urged organizations to identify PHP-based applications, including software that uses PHP indirectly. The UK’s National Cyber Security Centre also advised organizations to check their systems, prioritize internet-facing servers and install the available updates. It said organizations should consider taking systems offline if they could not protect them in time.

The Philippines also responded. On October 22, 2026, the National Computer Emergency Response Team of the Philippines issued an advisory about PHP2Shell.

The advisory urged government agencies, critical-infrastructure operators, website administrators and hosting providers to check their exposure. It recommended applying security updates, monitoring systems and reviewing exposed PHP services.

However, the advisory did not confirm that PHP2Shell had compromised a Philippine organization.

That distinction is important. A security warning does not prove that a successful attack has occurred. Likewise, evidence of attack attempts does not mean every targeted system was breached.

Governments and businesses responded because the flaws were serious and PHP was widely used. They did not need to wait for widespread damage before taking action.

Could AI also help attackers?

The same AI tools that help researchers find weaknesses may also help criminals study software and develop attacks.

As these tools improve, attackers may find it easier to examine code, test possible exploits and adapt their methods. That could shorten the time between the discovery of a flaw and attempts to exploit it.

However, this does not mean every attacker has the same tools or findings as legitimate security researchers. Nor does it prove that AI caused every attack linked to PHP2Shell.

The concern is that organizations may have less time to respond once a serious flaw becomes public.

Defenders gain an advantage when researchers report flaws responsibly, developers release fixes quickly and organizations install those fixes. But delays can give attackers more opportunities.

The PHP Foundation’s experience raises a wider question: how can small open-source teams handle a growing number of security reports without falling behind?

Better AI tools alone will not solve that problem. Projects also need funding, skilled maintainers, clear reporting channels and reliable ways to test proposed fixes.

Businesses and governments that depend on open-source software also have a reason to support the people who maintain it. Their services depend on software that needs regular security reviews and updates.

The real lesson goes beyond AI

PHP2Shell does not prove that AI has made the entire internet unsafe. But it does show how AI can change the way researchers discover and demonstrate software weaknesses.

Three problems came together in this incident.

First, complex software can contain flaws that remain difficult to understand for years. Second, the teams maintaining widely used open-source projects may lack the time and resources to resolve every difficult problem quickly. Third, organizations often struggle to update all the systems they operate.

AI helped researchers investigate the PHP flaws and show why they posed a serious risk. Once the findings became public, however, the main challenge shifted to securing vulnerable systems.

That work depends on developers releasing reliable fixes, hosting providers applying updates and organizations checking that their systems are protected.

The available evidence does not establish that every vulnerable website was compromised or that every organization installed the fixes.

What the incident does show is that security teams must prepare for faster vulnerability discovery. Organizations need accurate inventories of their software, clear update procedures and plans for systems that cannot be patched immediately.

AI can help uncover weaknesses faster. Whether that makes the internet safer will depend on how quickly people turn those findings into working fixes and deploy them across the systems that need protection.

Reporting Credit: Journos News — Original research and editorial analysis based on PHP Foundation security disclosures, official PHP security advisories, CERT-EU, ENISA, the UK National Cyber Security Centre, CERT-PH, OpenAI, Google Cloud, Cloudflare and corroborating cybersecurity reporting.

The post How AI Turned Longstanding PHP Security Flaws Into a Global Cybersecurity Emergency appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.