A pair of critical security vulnerabilities affecting PHP, one of the most widely used programming languages on the internet, has triggered an urgent response from governments, cybersecurity agencies, hosting providers, and website administrators around the world.
The vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — are collectively being referred to as PHP2Shell.
Both received a critical CVSS 4.0 score of 9.2 and can, under certain conditions, allow an unauthenticated attacker to remotely execute code on a vulnerable web server. Emergency patches were released on October 21, 2026.
But this incident is significant for another reason.
Artificial intelligence played an important role in turning long-hidden weaknesses in PHP into vulnerabilities researchers could practically demonstrate and understand.
The result has become one of the clearest examples yet of how AI is changing cybersecurity — for both defenders and attackers.
What Is PHP?
PHP is a server-side programming language that has helped power the web for decades.
Unlike code that runs directly inside a visitor’s browser, PHP usually operates on the web server. It can process requests, communicate with databases, handle logins, generate pages, process forms, and perform much of the behind-the-scenes work required by modern websites.
PHP is used by major content-management systems and web platforms, including WordPress, Drupal, Joomla, and MediaWiki.
Researchers at Wiz estimate that PHP is involved in roughly 70% of websites worldwide, which helps explain why vulnerabilities in PHP itself can have such far-reaching consequences.
What Is PHP2Shell?
PHP2Shell refers to two vulnerabilities affecting the PHP runtime itself rather than simply a particular website plugin or application.
The vulnerabilities are:
CVE-2026-109618 — Out-of-memory corruption
Under specific circumstances, PHP can run out of memory while internal request information is only partially initialized. Cleanup routines may then treat invalid data as legitimate, creating a path that can potentially lead to remote code execution.
CVE-2026-109619 — Stale global state
PHP can retain references to request information even after the underlying memory has been released. A later request handled by the same process may access that stale information, creating opportunities for memory disclosure and remote code execution.
The danger is particularly serious because exploitation may occur without the attacker first having a username or password.
In practical terms, successful exploitation could allow an attacker to run commands on the affected server with the privileges of the PHP process.
Depending on the server environment, that could potentially lead to stolen information, modified websites, malicious software installation, exposed credentials, or further attacks against connected systems.
Why Did This Become a Global Emergency?
PHP is deeply embedded throughout the modern internet.
The problem therefore was not limited to one company, one website platform, or one country.
Government agencies and organizations around the world began assessing their infrastructure, applying emergency patches, and in some cases temporarily taking websites offline while systems were secured.
The UK’s National Cyber Security Centre advised organizations to identify all systems running PHP, prioritize internet-facing infrastructure, apply the security updates immediately, investigate possible signs of compromise, and consider taking systems offline when patching or mitigation could not be completed promptly.
Similar warnings were issued internationally.
The scale of the response reflects the unusual combination of three factors:
PHP is extremely widespread.
The vulnerabilities can potentially allow unauthenticated remote code execution.
Technical information and exploitation attempts emerged rapidly around the disclosure.
That combination turned what could have been an ordinary software update into an international cybersecurity scramble.
AI Played a Major Role
One of the most interesting parts of the PHP2Shell story is how artificial intelligence contributed to the research.
Security researchers at Wiz reported using AI-powered tools while investigating PHP’s codebase. According to Wiz, frontier AI models substantially reduced the difficulty of turning longstanding programming weaknesses into demonstrable exploits.
The underlying memory-handling problems were not necessarily newly created vulnerabilities.
Some of the relevant code and design decisions had existed for years.
What changed was researchers’ ability to investigate extremely complicated relationships inside a large and mature codebase.
AI helped make that process faster and more practical.
This is an important development for cybersecurity.
Traditional vulnerability research can require enormous amounts of time from highly specialized engineers. AI can assist researchers in reviewing code, identifying unusual behavior, testing hypotheses, constructing proof-of-concept attacks, and validating potential fixes.
But the same capability creates a difficult question:
If defenders can use AI to discover complicated vulnerabilities faster, attackers potentially can too.
PHP2Shell therefore represents both the promise and the risk of AI-assisted cybersecurity.
Who Is Affected?
According to PHP’s official security guidance, organizations running PHP to serve web requests should treat the issue seriously.
Affected environments can include:
- PHP-FPM
- Apache with mod_php
- php-cgi
- FrankenPHP
- LiteSpeed environments using affected PHP releases
PHP says the risk is particularly serious for mod_php, where researchers demonstrated an unauthenticated attack that can occur before application code executes.
This distinction is important.
Having a WordPress, Drupal, Joomla, Laravel, or other PHP-based website does not mean the website has automatically been compromised.
Risk depends on factors including the PHP version, server configuration, deployment model, patch status, and whether attackers successfully targeted the system.
Nevertheless, systems exposed to the internet should be treated as a priority.
The Philippines Has Also Issued a Warning
The incident is relevant to Philippine website owners as well.
The National Computer Emergency Response Team of the Philippines (CERT-PH) issued an advisory on October 22 warning government agencies, critical infrastructure operators, website administrators, hosting providers, and cybersecurity organizations about PHP2Shell.
CERT-PH noted that the flaws could affect public-facing government services and private-sector systems using vulnerable PHP environments.
As of its advisory, the sources reviewed by CERT-PH had not established a confirmed PHP2Shell compromise of a Philippine organization, but the availability of public research and reported attack attempts made immediate assessment and patching necessary.
Which PHP Versions Fix the Problem?
PHP released the following patched versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Administrators should upgrade to an appropriate fixed and supported release rather than assuming that an older PHP installation is safe simply because it has been running without problems.
PHP 8.1 and older upstream branches are already unsupported, making migration especially important for systems still relying on legacy versions.
What Website Owners Should Do Now
For website owners and system administrators, the most important action is straightforward:
Patch PHP immediately.
- Administrators should also:
- Identify every server, website, application, container, and service using PHP.
- Prioritize anything accessible directly from the internet.
- Upgrade to a fixed PHP release or obtain the appropriate security update from the operating-system or hosting vendor.
- Review web server and PHP logs for suspicious activity.
- Look for unexpected files, accounts, processes, scheduled tasks, or other signs of compromise.
- Update third-party software and appliances that may include PHP internally.
- Back up important systems and databases.
- Temporarily isolate or disable vulnerable services that cannot be safely patched.
- Test websites and applications after upgrading.
- Continue monitoring vendor advisories because the situation may evolve.
The official PHP project has emphasized that updating is the safe solution, rather than relying indefinitely on partial workarounds.
What About WordPress Website Owners?
WordPress relies heavily on PHP, so administrators should take the warning seriously.
However, simply updating the WordPress core or individual plugins is not necessarily enough.
PHP itself normally runs at the server or hosting-account level.
Website owners should therefore check which PHP version their server is using and confirm with their hosting provider that the PHP2Shell security fixes have been deployed.
Managed hosting customers may receive these updates automatically, but they should still verify rather than assume.
Owners of VPS, cloud servers, dedicated servers, or self-managed infrastructure have greater responsibility because PHP updates may require direct server administration.
What Should Ordinary Internet Users Do?
The main responsibility lies with organizations operating vulnerable systems rather than ordinary website visitors.
Users do not need to stop using every website built with PHP.
However, it is sensible to remain alert.
If a service you use announces a security incident, follow its official instructions.
If you receive a legitimate password-reset request following a confirmed compromise, update your credentials and avoid reusing the same password elsewhere.
Be especially cautious about phishing messages pretending to offer a “PHP security update” or asking you to click suspicious links.
Major security incidents frequently create opportunities for scammers to exploit public concern.
The Bigger Lesson: AI Is Changing Cybersecurity
PHP2Shell is bigger than two security vulnerabilities.
It demonstrates how quickly vulnerability research itself is changing.
Software that has been inspected by developers and security professionals for years may still contain weaknesses that previously required too much time or technical complexity to exploit.
AI changes that equation.
It can give defenders the ability to examine enormous codebases, test complex ideas, and identify problems that may otherwise remain hidden.
But it can also lower some of the barriers facing attackers.
The cybersecurity industry may therefore be entering an era where vulnerabilities are discovered — and potentially weaponized — much faster than before.
That makes basic security practices even more important:
Keep software supported.
Patch quickly.
Know what is running on your infrastructure.
Monitor for compromise.
Do not wait for a major incident before modernizing outdated systems.
PHP2Shell is a reminder that even technology sitting quietly underneath millions of websites can suddenly become the center of a global security emergency.
And increasingly, AI may be the technology that discovers the next one.
