Critical PHP Vulnerabilities Expose Majority of Websites to Remote Attacks

In October 2026, two critical security vulnerabilities were discovered in PHP, the open-source programming language that powers approximately 70% of websites worldwide. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed “PHP2Shell,” these flaws allow unauthenticated remote code execution, enabling attackers to take control of affected web servers without needing any credentials.

PHP is widely used for building web applications and dynamic websites, including major platforms like WordPress, Drupal, Joomla, and Wikipedia’s MediaWiki. Because these vulnerabilities reside in PHP’s core engine, they affect virtually all PHP-powered sites regardless of the security of their individual application code.

The vulnerabilities stem from complex memory corruption issues during PHP request processing. CVE-2026-109618 involves out-of-memory (OOM) handling that can leave partially initialised internal data in an unsafe state, while CVE-2026-109619 results from stale global state persisting after memory has been freed. Both can be exploited remotely without authentication, making them especially dangerous.

These bugs were initially discovered in 2024 but were not considered exploitable until recently, when researchers demonstrated how to chain multiple flaws for remote code execution. Security teams coordinated a rapid response, and on October 21, 2026, the PHP Foundation released patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older versions like PHP 8.1 and below are no longer officially supported, though some vendors have backported fixes.

Despite these efforts, Amazon Threat Intelligence reported exploitation attempts as early as October 17, four days before the public disclosure and patch release. Attackers used anonymised networks to hide their activity, and multiple groups tried different exploit methods. This early activity underscores the shrinking window defenders have to patch critical vulnerabilities before attacks begin.

Security experts emphasise that no configuration-only mitigations fully address the flaws; upgrading PHP to the patched versions is the only complete solution. Some temporary measures, such as disabling PHP’s session upload progress feature, can reduce exposure but are not substitutes for patching.

Major internet companies, including Cloudflare, deployed web application firewall (WAF) protections ahead of the public announcement, helping to block many attack attempts. Nevertheless, the widespread use of PHP across web servers, developer tools, and network devices means patching will be a complex and ongoing process.

Researchers at Wiz demonstrated unauthenticated remote code execution against popular CMS platforms running PHP containers and also showed that the vulnerabilities could expose sensitive data from PHP worker memory, such as credentials and API keys. The flaws affect PHP itself rather than the applications built on it, meaning even minimal PHP setups are vulnerable.

The U.K. National Cyber Security Centre (NCSC) urged organisations to urgently identify all PHP installations, prioritise internet-facing systems for patching, and consider taking vulnerable systems offline if immediate updates are not feasible. Continuous monitoring for signs of compromise and applying vendor updates promptly remain crucial.

On October 23, 2026, the PHP project published an informational advisory for a related but less likely remote code execution vulnerability (CVE-2026-115560) involving PHP’s session upload progress feature. This issue requires an unusual combination of configuration and application behaviour and is being addressed in a routine update.

The PHP2Shell incident highlights the persistent risks posed by legacy software powering much of the internet. It also illustrates how advances in artificial intelligence have accelerated the discovery and exploitation of complex vulnerabilities, reducing the time available for defenders to respond. While the internet avoided a catastrophic outage, the event serves as a stark reminder that timely patching and vigilant security practices are essential to protect critical infrastructure.