Two critical security flaws in PHP, the programming language behind most of the world's websites, sent organisations scrambling on Wednesday, 21 October 2026. The bugs, nicknamed "PHP2Shell", had gone unnoticed for more than a decade and were found with the help of artificial intelligence. Attackers were already exploiting them, and governments in the Netherlands, Denmark, Finland and France took websites offline as a precaution, according to Reuters.
What are the flaws?
- CVE-2026-109618: a memory corruption bug triggered when PHP runs out of memory.
- CVE-2026-109619: internal state left behind and reused after memory is freed.
Both allow an attacker to run their own code on a web server without logging in, according to Help Net Security, the most serious kind of web vulnerability.
Who needs to update
| PHP branch | Fixed version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 7.4–8.1 | Source patches released |
The fixes went live at about 13:45 GMT on 21 October. Security firm Wordfence warned that automatic updates will not apply the fix, so site owners must upgrade PHP themselves or ask their hosting provider to do it. Small sites on shared hosting are seen as most at risk.
Found by AI
Wiz, the cloud security company owned by Alphabet, said it found the flaws using its own AI tool, Wiz Atlas, together with models from Google and OpenAI. Wiz said the bugs "remained hidden in the PHP codebase for more than a decade." Another firm, Calif, said it had found them with a large language model on 1 August.
The case is a vivid example of how AI is changing cybersecurity in both directions. "With AI exploitation may happen instantly, on a large scale," said Lukasz Olejnik of King's College London, quoted by Reuters.
Attacks already under way
Amazon said it saw an attempt to exploit the bugs on one of its decoy servers on 17 October, four days before they were disclosed, and that the flaws were "now being broadly exploited in the wild." Cloudflare's chief technology officer, Dane Knecht, said: "We are seeing early attacks emerging."
Sites taken offline included the Dutch National Cyber Security Centre, the government portal Overheid.nl and the Port of Rotterdam, as well as services run by Denmark's Kombit, Finland's Valtori and France's Interior Ministry, according to Reuters. Japan's Prime Minister Sanae Takaichi urged website owners on X to check for PHP and apply the fix.
Why it matters
PHP is used by about 75% of websites whose server-side language can be identified, according to W3Techs data cited by Reuters, and WordPress, which runs on PHP, powers around 43% of all sites. Data from Censys suggests about 1.5 million of 2.6 million PHP hosts it tracks run versions with no fix available, meaning they need a bigger upgrade.
What to do
- Check which PHP version your site or server runs.
- Upgrade to the fixed version for your branch, or move off unsupported versions.
- If you use shared hosting, contact your host to confirm they have patched.
- The UK's National Cyber Security Centre advises taking unpatched systems offline.
