PHP issues emergency updates after evidence of 'php2shell' exploit attempts

PHP on Oct. 21 released emergency security updates for two critical vulnerabilities after evidence emerged that attackers had already begun probing the flaws before full public disclosure, setting off an urgent patching push across the web.

The updates cover supported branches PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. In its advisory, the project said “these releases fix two critical vulnerabilities … If you run PHP, it is imperative that you update now.” The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed “php2shell” by researchers, were each scored 9.2 under CVSS v4.0.

The urgency reflects both PHP’s reach and where the flaws sit. PHP is used by about 69% of websites where the server-side language can be detected, according to W3Techs. And these were remote-code-execution flaws in the PHP runtime itself — the core software that executes PHP code — rather than bugs limited to one application or plugin. PHP said affected attack surfaces include mod_php and PHP-FPM, two common ways sites run PHP. After the release, the Cybersecurity and Infrastructure Security Agency, the U.S. government’s lead civilian cyber agency, along with CERT-EU, ENISA and other national agencies, urged organizations to patch immediately. In the immediate aftermath, a Censys tracker cited by the Electronic Frontier Foundation on Oct. 23 indicated more than 33 million websites were still running vulnerable PHP versions, though internet-wide scanner counts vary by methodology and can change quickly as updates roll out.

The vulnerabilities were not entirely new to maintainers. The PHP Foundation said a 2024 external security audit had identified related memory and out-of-memory concerns, but a complete remote-code-execution fix was not shipped then because exploitability had not yet been fully demonstrated and other issues were prioritized. That changed this year. According to the foundation, security researcher Calif reported an unconditional remote-code-execution path on Aug. 11, 2026, and OpenAI and cloud security firm Wiz reported similar findings in August and September. Before the public release, AWS Threat Intelligence said its MadPot honeypots recorded an attempted php2shell exploitation on Oct. 17, evidence that the bugs were already attracting attacker interest.

The disclosure process then began to fray. The PHP Foundation said public circulation of the CVE identifiers on Oct. 20, along with an archived Hacker News post, forced the project to publish an advance notice at 19:30 UTC and move the planned release up to Oct. 21 at 14:00 UTC.

Even before that revised release time, the foundation said, patched software had already been published elsewhere. “On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix,” the foundation wrote in a blog post. Chainguard, a software supply chain security company that publishes hardened container images, disputed the premise that waiting longer was the right call once exploitation had surfaced. As quoted by The Register, Chainguard CEO Dan Lorenc said: “I made the call to get these out early when exploits hit in the wild.” The dispute underscored how quickly coordinated disclosure can break down when a severe bug is already leaking into public view and defenders are racing attackers.

The episode also added a measured artificial intelligence angle. The PHP Foundation said Calif, OpenAI and Wiz all reported related findings, and OpenAI said Calif used GPT-5.6 Sol in the audit effort. Wiz separately said it independently found and reported both vulnerabilities. But the record here is one of AI-assisted research with human validation, not an automated system independently discovering, triaging and fixing a critical internet bug. Human researchers identified the issue, confirmed exploitability, coordinated reporting and worked through patching.

For website operators, the takeaway is straightforward. PHP’s advisory said there are temporary mitigations for some setups, but “there are no complete mitigations — updating is the only safe choice.” Because the flaws affect the runtime itself, the risk is broader than a single content management system or hosting platform. The incident is also a test for the PHP Foundation, which had already been trying to strengthen security work in 2026 by adding staff and creating an Ecosystem Security Team. This week’s scramble showed why: when a core open-source technology used across a large share of the web ships a critical fix under active pressure, both the code and the disclosure process come under strain fast.