Critical PHP2Shell emergency

What's happened

Security researchers have found two critical PHP vulnerabilities, dubbed PHP2Shell, and PHP maintainers have released emergency patches. Multiple governments and major companies have urged operators to patch or temporarily take sites offline after AI-assisted research and a public leak triggered millions of exploitation attempts between 21–27 October 2026.

What's behind the headline?

What happened and why it matters

AI-assisted research has exposed two critical vulnerabilities in PHP that allow unauthenticated remote code execution. The flaws—CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell—affect PHP releases dating back to PHP 5 and therefore touch a large portion of the web stack, including WordPress and other widely used platforms. Because PHP runs code on servers before pages reach users, attackers can read memory, access databases, or install backdoors without credentials.

Immediate operational impact

• Governments and large firms have been taking sites offline while they install patches and test systems. Cloud providers and security teams have recorded millions of exploit attempts after technical details leaked.
• Organisations that cannot patch immediately are being told to isolate PHP servers or take services offline; doing nothing will leave systems open to automated scanning and mass exploitation.

Root causes

• The vulnerabilities have existed for years and were not previously considered exploitable. AI models (OpenAI's GPT-5.6 Sol and others) helped researchers chain flaws into practical exploits.
• Long-term underfunding of open-source infrastructure and limited security resources for PHP maintenance have increased the risk that deep bugs remain unnoticed.

What will happen next

• Patching will reduce exposure for well-resourced operators, but a long tail of poorly maintained sites will remain vulnerable. Automated AI-driven tooling will make it faster for attackers to weaponise leaked exploit chains, so exploitation attempts will continue.
• Incident response and monitoring will become standard across more organisations; some smaller sites and legacy systems will be compromised and used as footholds or for cryptomining, spam or DDoS infrastructure.

Practical takeaways

• Update PHP to the patched versions immediately.
• If immediate update is not possible, isolate or temporarily take web services offline and monitor logs for suspicious activity.
• Expect further disclosures of AI-found vulnerabilities in widely used, under-resourced open-source projects.

How we got here

Researchers at Calif and Wiz have identified two long-standing PHP flaws using AI. PHP maintainers have issued fixes and coordinated disclosures; agencies including the NSA and national CERTs have warned organisations to update immediately or isolate vulnerable servers to prevent remote unauthenticated code execution.

Our analysis

Several outlets agree on the core facts but emphasise different angles. OpenAI and New York Times describe AI’s central role: the New York Times reported that Calif used OpenAI’s GPT-5.6 Sol and that Wiz independently confirmed the flaws, noting OpenAI’s description of the discovery as “one of the most impactful security issues in recent memory.” TechCrunch and CNBC focus on operational pressure: TechCrunch reported that CISA warned of in-the-wild exploitation and that organisations and governments took services offline to patch, while CNBC detailed early leakage and patch timing, noting Calif accidentally posted a proof-of-concept video that accelerated public disclosure. Cloud infrastructure perspectives appear in multiple pieces: Cloudflare’s Matthew Prince quantified the spike in exploit attempts—“thousands… tens of thousands… millions”—a sequence cited by Sky News, France 24 and AP. Regional responses vary: The Moscow Times and Arab News document national advisories and ordered scans, with Russia’s FSB instructing shutdowns and broad inspections, while Finland’s Valtori and Japan’s ministries are quoted by Arab News and France 24 describing precautionary shutdowns and staggered service restorations. Direct quotes illustrate the tone: OpenAI told readers it considered the flaws “one of the most impactful security issues in recent memory” (New York Times / OpenAI blog); the PHP Foundation warned users to “update immediately” (Al Jazeera). TechCrunch and BBC emphasise structural issues in open-source maintenance, with PHP maintainers acknowledging a “structural failure” and lack of resources (CNBC/BBC). These differences matter: some outlets foreground AI’s role in discovery, others foreground the operational scramble and service outages, and some underscore long-term funding and maintenance failures that allowed deep bugs to persist.

Go deeper

• Which PHP versions and hosting setups remain vulnerable?
• How can small sites without dedicated ops teams apply the patch safely?
• Will this prompt sustained funding for PHP and other core open-source projects?

More on these topics

• PHP - Programming language

  PHP is a general-purpose scripting language geared towards web development. It was created by Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995. The PHP reference implementation is now produced by the PHP Group.

• Cloudflare - Internet company

  Cloudflare, Inc. is an American web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

• OpenAI - Artificial intelligence company

  OpenAI is an artificial intelligence research laboratory consisting of the for-profit corporation OpenAI LP and its parent company, the non-profit OpenAI Inc.

• National Security Agency - Intelligence agency

  The National Security Agency is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence.

• WordPress - Application programming interface

  WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

• Wikipedia - Website

  Wikipedia is a multilingual online encyclopedia created and maintained as an open collaboration project by a community of volunteer editors using a wiki-based editing system. It is the largest and most popular general reference work on the World Wide Web.

• United Kingdom - Country in Europe

  The United Kingdom of Great Britain and Northern Ireland, commonly known as the United Kingdom or Britain, is a sovereign country located off the north­western coast of the European mainland.

• European Union

  The European Union is a political and economic union of 27 member states that are located primarily in Europe. Its members have a combined area of 4,233,255.3 km² and an estimated total population of about 447 million.

• Google - Technology company

  Google LLC is an American multinational technology company that specializes in Internet-related services and products, which include online advertising technologies, a search engine, cloud computing, software, and hardware.

• Netherlands - Country in Europe

  The Netherlands, informally Holland, is a country primarily located in Western Europe and partly in the Caribbean, forming the largest constituent country of the Kingdom of the Netherlands.

• France - Country in Europe

  France, officially the French Republic, is a country consisting of metropolitan France in Western Europe and several overseas regions and territories.

• Wikimedia Foundation - Non-profit

  The Wikimedia Foundation, Inc. is an American non-profit and charitable organization headquartered in San Francisco, California. The WMF owns and operates Wikipedia as well as other Wikimedia projects. The content on these projects is written by volunteer

• Finland - Country in Europe

  Finland, officially the Republic of Finland, is a Nordic country in Northern Europe. It shares land borders with Sweden to the west, Russia to the east, Norway to the north, and is defined by the Gulf of Bothnia to the west, and the Gulf of Finland of the

• Japan - Country in East Asia

  Japan is an island country of East Asia in the northwest Pacific Ocean. It borders the Sea of Japan to the west and extends from the Sea of Okhotsk in the north to the East China Sea and Taiwan in the south.

• Port of Rotterdam - Largest port in Europe, located in the city of Rotterdam, Netherlands

  The Port of Rotterdam is the largest seaport in Europe, and the world's largest seaport outside of Asia, located in and near the city of Rotterdam, in the province of South Holland in the Netherlands. From 1962 until 2004, it was the world's busiest port by annual cargo tonnage. It was overtaken first in 2004 by the port of Singapore, and since then by Shanghai and other very large Chinese seaports. In 2020, Rotterdam was the world's tenth-largest container port in terms of twenty-foot equivalent units (TEU) handled. In 2017, Rotterdam was also the world's tenth-largest cargo port in terms of annual cargo tonnage. Covering 105 square kilometres (41 sq mi), the port of Rotterdam stretches over a distance of 40 kilometres (25 mi). It consists of the city centre's historic harbour area, including Delfshaven; the Maashaven/Rijnhaven/Feijenoord complex; the harbours around Nieuw-Mathenesse; Waalhaven; Vondelingenplaat; Eemhaven; Botlek; Europoort, situated along the Calandkanaal, Nieuwe Waterweg and Scheur (the latter two being continuations of the Nieuwe Maas); and the reclaimed Maasvlakte area, which projects into the North Sea. The Port of Rotterdam is located in the middle of the Rhine...

• Wiz - Wikimedia disambiguation page

  Wiz may refer to:

• National Cyber Security Centre - Wikimedia disambiguation page

  National Cyber Security Centre, National Cyber Security Center, or National Cybersecurity Center may refer to:

• City of Edinburgh Council - Scottish unitary authority council in Edinburgh, Scotland, UK

  The City of Edinburgh Council is the local government authority for the City of Edinburgh. It was created in 1996 under the Local Government etc. Act 1994, with the boundaries of the post-1975 City of Edinburgh District Council of the Lothian region.

• Australia - Country in Oceania

  Australia, officially known as the Commonwealth of Australia, is a sovereign country comprising the mainland of the Australian continent, the island of Tasmania, and numerous smaller islands.

• South Korea - Country in East Asia

  South Korea, officially the Republic of Korea, is a country in East Asia, constituting the southern part of the Korean Peninsula and sharing a land border with North Korea.

• The United States of America - Country in North America

  The United States of America, commonly known as the United States or America, is a country mostly located in central North America, between Canada and Mexico.

• Microsoft - Technology company

  Microsoft Corporation is an American multinational technology company with headquarters in Redmond, Washington. It develops, manufactures, licenses, supports, and sells computer software, consumer electronics, personal computers, and related services.

• Singapore - Country in Asia

  Singapore, officially the Republic of Singapore, is a sovereign island city-state in maritime Southeast Asia. It lies about one degree of latitude north of the equator, off the southern tip of the Malay Peninsula, bordering the Straits of Malacca to the w

• Joomla - System software

  Joomla, also spelled Joomla! and sometimes abbreviated as J!, is a free and open-source content management system for publishing web content on websites.

• TechCrunch

  TechCrunch is an American online publisher focusing on the tech industry. The company specifically reports on the business related to tech, technology news, analysis of emerging trends in tech, and profiling of new tech businesses and products.

• University of New South Wales - Public research university Kensington, Sydney, Australia

  The University of New South Wales (UNSW; branded as UNSW Sydney since 2017) is an Australian public research university located in the Sydney suburb of Kensington. In 2012, UNSW recorded the highest median ATAR of any university in NSW and attracted the..

• California - US State

  California is a state in the Pacific Region of the United States. With 39.5 million residents across a total area of about 163,696 square miles, California is the most populous U.S. state and the third-largest by area, and is also the world's thirty-fourt

• Amazon - E-commerce company

  Amazon.com, Inc., is an American multinational technology company based in Seattle, Washington. Amazon focuses on e-commerce, cloud computing, digital streaming, and artificial intelligence.

• Sanae Takaichi - Japanese Politician

  Sanae Takaichi is a conservative Japanese politician.

• Matthew Prince - CEO of CloudFlare

  Matthew Browning Prince is an American billionaire businessman and executive. He is the co-founder, executive chairman, and chief executive officer of the technology company Cloudflare.

• Wiz - IT security company

  Wiz is a cloud security startup headquartered in New York City. The company was founded in January 2020 by Assaf Rappaport, Yinon Costica, Roy Reznik, and Ami Luttwak, all of whom previously founded Adallom.

• Edinburgh - Capital of Scotland

  Edinburgh is the capital of Scotland and one of its 32 council areas. Historically part of the county of Midlothian, it is located in Lothian on the Firth of Forth's southern shore.

• Federal Bureau of Investigation - Law enforcement agency

  The Federal Bureau of Investigation is the domestic intelligence and security service of the United States and its principal federal law enforcement agency.

• Python - High-level programming language

  Python is an interpreted, high-level, general-purpose programming language. Created by Guido van Rossum and first released in 1991, Python's design philosophy emphasizes code readability with its notable use of significant whitespace.

• GitHub - Company

  GitHub, Inc. is an American multinational corporation that provides hosting for software development and version control using Git. It offers the distributed version control and source code management functionality of Git, plus its own features.

• Paris - Capital of France

  Paris is the capital and most populous city of France, with an estimated population of 2,150,271 residents as of 2020, in an area of 105 square kilometres.

• Kingdom of Saudi Arabia - Country in the Middle East

  Saudi Arabia, officially the Kingdom of Saudi Arabia, is a country in Western Asia constituting the bulk of the Arabian Peninsula.