Full Breakdown
AI-Driven Discovery of Critical PHP Hypertext Preprocessor (PHP) Vulnerabilities Sparks Global Patch Rush
By Drooid · · How we work
Core Event: Emergency Disclosure of “PHP2Shell” Flaws
In late October 2026, the PHP Foundation released emergency patches for two remote-code-execution bugs—CVE-2026-109618 and CVE-2026-109619—collectively dubbed “PHP2Shell.” The flaws let unauthenticated attackers run code on any server running PHP, which powers roughly 70 % of websites. AI models from OpenAI, Google-owned Wiz, and Calif uncovered the bugs, prompting a coordinated disclosure and a worldwide scramble to apply the fixes.
Background & Context
PHP, created in the early 1990s as “Personal Home Page,” underlies platforms such as WordPress, Drupal, Joomla and sites like Microsoft.com and Wikipedia.org. Over the past decade, AI models have been used to scan PHP’s codebase, revealing flaws that had persisted for years.
Timeline
- October 17 2026 – AWS researchers saw an anonymized IP probing a honeypot for the undisclosed bugs.
- October 20 2026 – A leak on developer forums disclosed the CVE identifiers ahead of the embargo.
- October 21 2026 – The PHP Foundation published emergency patches and advisory; governments issued alerts, and the Baden-Württemberg Ministry of the Interior displayed a warning page.
Data & Statistics
- Coverage: About 70 % of web servers run PHP; WordPress accounts for roughly 40 % of public-facing sites.
- Exposure: Palo Alto Networks identified 22.6 million potentially vulnerable instances; a Shodan search counted ~1.9 million internet-exposed hosts.
- Severity: Both CVEs received a CVSS 9.2 rating (critical).
Official Statements & Responses
- The U.S. National Security Agency urged immediate patching and advised taking affected systems offline if updates could not be applied promptly.
- CISA warned that the vulnerabilities allow unauthenticated remote code execution and recommended rapid remediation.
- Sanae Takaichi, Japan’s prime minister, posted an urgent request for organizations to apply the fix or suspend services.
- China’s industry ministry called for comprehensive inspections and immediate upgrades.
- Cloudflare deployed WAF rules to block known exploit vectors, while Amazon reported early probing activity on its “MadPot” detection system.
Criticism & Opposition
- Dimitrios Salampasis of Swinburne University noted that taking sites offline can be a responsible protective measure while patches are applied.
- Rahat Masood, senior lecturer at UNSW, cautioned that patched sites remain vulnerable if third-party components continue to use unpatched PHP code.
Conflicting Reports & Gaps
- Early exploitation: AWS’s CJ Moses reported an anonymized probe on October 17, suggesting a threat actor accessed exploit details before public disclosure.
- No confirmed in-the-wild abuse: CISA and Huntress analyst Jon Semon said they had not observed successful exploitation on live customer systems as of the patch release.
- Industry observations: Fastly’s Kelly Shortridge described clear evidence of active reconnaissance across PHP applications, while other agencies emphasized the lack of confirmed breaches, reflecting limited visibility into private networks.
What’s Next
Security vendors continue to monitor exploit traffic, with Cloudflare and Amazon updating detection signatures in real time. The PHP Foundation has released minimal back-ports for legacy branches (PHP 7.4, 8.0, 8.1) and urges organizations unable to upgrade immediately to isolate internet-facing services. Researchers expect AI models to surface more high-impact bugs, driving ongoing “Defender’s Window” initiatives to coordinate pre-emptive patches before attackers can weaponize disclosed code.