Two PHP Vulnerabilities Just Shook the Internet. Here’s What Happened.

Imagine waking up, opening a government website, and discovering that it is temporarily unavailable.

Not because the server crashed. Not because of scheduled maintenance. And not because somebody forgot to renew the domain.

The website was deliberately taken offline because of a security vulnerability.

That is exactly what happened to several websites on October 21, 2026.

Government agencies, businesses, and website administrators suddenly found themselves dealing with two critical security vulnerabilities in PHP, one of the most widely used programming languages on the internet.

The vulnerabilities are collectively called PHP2Shell, and they can potentially allow attackers to execute malicious code on vulnerable servers without even logging in.

As someone who has been working with WordPress, PHP, and website development for more than a decade, I think this incident deserves more attention than an ordinary security update.

Because this time, the problem is not necessarily your website’s code.

It is something much deeper.

What Exactly Happened on October 21, 2026?

On October 20, information about two critical PHP security vulnerabilities started circulating publicly, ahead of their planned disclosure.

The PHP security team had been preparing fixes, but the early leak increased the urgency.

On October 21, the team released emergency security updates addressing both vulnerabilities.

The issues were assigned these identifiers:

• CVE-2026-109618: Remote code execution through out-of-memory corruption.
• CVE-2026-109619: Remote code execution through stale global state.

Both vulnerabilities received a critical severity rating of 9.2 out of 10 under CVSS version 4.0.

Now, you might be thinking that security vulnerabilities are discovered every day.

And you are right.

WordPress plugins get security updates. Browsers receive patches. Operating systems have vulnerabilities. This is normal in software development.

But PHP2Shell is different because the vulnerabilities exist inside PHP itself.

That means fixing a plugin or updating an application does not necessarily solve the problem.

Why Is PHP2Shell Such a Serious Security Issue?

Let me explain this without making it unnecessarily technical.

Normally, when hackers try to compromise a WordPress website, they might look for vulnerable plugins, outdated themes, weak passwords, or insecure custom functionality.

But PHP2Shell introduces another possible entry point.

An attacker may be able to send a specially crafted HTTP request that triggers unsafe memory handling inside PHP.

And under the right conditions, that can lead to Remote Code Execution (RCE).

RCE simply means an attacker can make the target server execute code they control.

Depending on the server’s permissions and configuration, successful exploitation could allow someone to:

• Read sensitive configuration files.
• Access database credentials or API keys.
• Modify website files.
• Install malicious scripts.
• Extract information from the PHP process’s memory.
• Use the compromised website or server for additional attacks.

 

There is an important distinction here.

RCE does not automatically mean an attacker has complete root access to the entire server.

The confirmed exploits initially execute with the PHP web worker’s privileges. But those privileges may already be enough to access sensitive application data or modify files.

And that is serious enough.

The Two Vulnerabilities Are Actually Different

Although both issues are grouped under PHP2Shell, they involve different problems in PHP’s memory management.

Vulnerability	What goes wrong
CVE-2026-109618	PHP runs out of memory during a sensitive operation, leaving some internal data improperly initialized.
CVE-2026-109619	PHP fails to clear certain internal references properly, allowing a later request to access memory that should no longer be used.

You do not need to understand every internal PHP function to understand why this matters.

Think about a website processing thousands of requests.

PHP allocates memory, processes a request, and cleans things up afterward.

But what happens if that process stops halfway through?

Or what if information from an earlier request is accidentally reused?

That is the kind of problem these vulnerabilities exploit.

Researchers demonstrated that these memory-handling weaknesses could be turned into working attacks.

In fact, Wiz Research demonstrated unauthenticated remote code execution against WordPress, Drupal, and Joomla environments.

And these demonstrations were not based on finding vulnerable plugins in those platforms.

The underlying issues were in PHP.

Why Did Websites Actually Go Offline?

This is probably the part that surprised people the most.

Several government and public-facing services across Europe were temporarily taken offline while administrators assessed their exposure and applied security updates.

Countries affected by precautionary shutdowns included the Netherlands, Finland, France, Germany, and Belgium, according to reporting on October 21.

But here is something worth understanding.

A website going offline does not necessarily mean it was hacked.

Some organizations deliberately disabled affected services because temporarily losing access to a website was considered less risky than leaving a potentially vulnerable server publicly accessible.

The European Union Agency for Cybersecurity, ENISA, also recommended isolating exposed applications when immediate patching was not possible.

And honestly, I understand that decision.

If a website contains sensitive information and the security team cannot immediately verify that its PHP environment is protected, temporarily restricting public access can be a reasonable precaution.

Downtime is inconvenient.

A security breach involving sensitive data could be much worse.

How Did These Vulnerabilities Go Undetected for So Long?

This is where the story becomes even more interesting.

According to the PHP Foundation, early signs of the memory-management problem behind one of these vulnerabilities were identified during security work in 2024.

However, finding a theoretical weakness and demonstrating that someone can exploit it remotely are two different things.

The potential impact was not fully established at that stage, and attempts to develop a safe fix encountered technical difficulties.

Then, in 2026, further security research changed the situation.

Researchers from Calif, OpenAI, and Google’s Wiz contributed findings and exploit demonstrations. AI-assisted tools played a significant role in this research.

The important part is not that AI magically hacked PHP.

Researchers still had to understand the problem, develop attack techniques, verify the impact, and coordinate fixes.

But advanced AI tools helped make certain complicated vulnerability-research tasks much more practical.

And I think this is one of the most interesting developments in cybersecurity right now.

We are entering a period where AI can help security researchers discover weaknesses that have existed in widely used software for years.

That is genuinely useful for defenders.

Unfortunately, similar capabilities could also make it easier for attackers to analyze vulnerabilities and adapt exploits.

I have written about this changing relationship between AI and cybersecurity in my article on GPT-6 Astra and Claude’s newer models.

Is PHP2Shell Already Being Exploited?

There is an important difference between three situations:

1. Security researchers successfully demonstrating an exploit.
2. Attackers attempting to exploit vulnerable websites.
3. Confirmed successful compromises of real websites.

The first two have been reported.

Security researchers demonstrated working exploits, and Cloudflare reported observing malicious traffic targeting PHP2Shell, including attempts to adapt requests around its protections.

However, as of this article’s research cutoff on October 22, I could not verify evidence of widespread successful compromises directly attributable to these vulnerabilities.

That distinction matters.

We should take the threat seriously without automatically assuming that every vulnerable website has already been hacked.

Does This Affect Every WordPress Website?

Not necessarily.

It depends on the PHP runtime, whether the relevant security patches have been applied, and how the hosting environment is configured.

The vulnerabilities are relevant to PHP installations serving web requests, including environments using Apache with mod_php, PHP-FPM, and other supported PHP execution methods.

And the problem extends beyond WordPress.

Drupal, Joomla, Magento, Laravel applications, custom PHP websites, and other software that depends on vulnerable PHP installations may also be exposed.

You may have seen headlines suggesting that approximately 70% of websites could be affected.

That figure broadly reflects how widely PHP is used. It does not mean that 70% of websites have been compromised or that every PHP website is currently vulnerable.

Patched installations and unaffected non-PHP systems are different cases.

PHP2Shell: Real Exploit Demonstrations

Wiz Research demonstrated how PHP2Shell could enable remote code execution across different PHP-based platforms. These demonstrations show why the vulnerability is not limited to WordPress.

Video demonstrations by Wiz Research. Source: Wiz PHP2Shell Research

Has PHP2Shell Been Fixed?

Yes.

The PHP development team released the following security updates on October 21, 2026.

PHP version	Patched release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

PHP 8.1 and older versions are no longer maintained through the normal upstream security-release process.

However, some Linux distributions and hosting vendors provide security backports for older PHP branches.

This means an older version number alone is not always enough to determine whether a vendor-maintained installation is protected.

The key is confirming that the relevant security fixes have actually been installed.

For the latest information, refer directly to the official PHP security announcement.

What This Incident Reminds Me About Website Development

There is something I have noticed repeatedly while working on websites.

A website can look perfectly fine from the outside while relying on outdated or poorly maintained technology underneath.

Everything loads.

The forms work.

The design looks good.

Nobody complains.

So people naturally assume everything is fine.

But visual appearance tells you almost nothing about the security of the underlying server environment.

I discussed a similar maintenance problem in Why Most Business Websites Become Hard to Manage Over Time.

PHP2Shell is another reminder that website maintenance goes beyond updating content, plugins, and themes.

It also involves the runtime, operating system, hosting provider, libraries, dependencies, and security configurations.

And sometimes, the most serious problem is in a component the website owner has never even heard of.

Frequently Asked Questions

Is PHP2Shell a WordPress vulnerability?

No. PHP2Shell refers to vulnerabilities in PHP itself. WordPress websites can be affected because WordPress uses PHP, but the vulnerabilities are not specific to WordPress.

Can hackers exploit PHP2Shell without a password?

Under the demonstrated attack conditions, yes. Researchers confirmed that remote code execution can be achieved without authentication on vulnerable configurations.

Does Cloudflare protect against PHP2Shell?

Cloudflare has deployed protections against known PHP2Shell attack patterns, including for customers using its WAF on the Free plan. However, the company still recommends patching PHP because firewall rules are not a complete replacement.

Are websites safe after installing the official patch?

The official PHP updates address these two vulnerabilities. Administrators should also restart affected services, verify the deployed runtime, and check for signs of any earlier compromise.

Was PHP2Shell discovered by AI?

AI-assisted security research contributed significantly to discovering and demonstrating the issues. The work involved multiple researchers, organizations, and the PHP security team.

Final Thoughts

I think PHP2Shell will be remembered for more than just two PHP vulnerabilities.

It highlights how dependent the internet is on software components that most people never see.

And it shows how quickly the security landscape is changing as AI becomes more capable.

For website owners, the lesson is straightforward.

A working website is not necessarily a secure website.

And security is not something that should only receive attention when a major vulnerability starts trending.

If you manage a PHP website, verify that the appropriate patches have been installed.

If your hosting provider handles PHP updates, ask them to confirm the security status.

Because the technology running behind your website matters just as much as the website itself.

Until next time, stay strong and keep learning.