Security ·
PHP2Shell: two critical PHP flaws put most websites at risk, and attacks have started
On 21 October PHP shipped emergency fixes for two flaws that let an attacker run code on a server without logging in. They affect practically every PHP version of the last ten years, and Czech cyber agency NUKIB urges immediate updates.
CVE-2026-109618 and CVE-2026-109619 are rated 9.2 under CVSS 4.0. Both come from how PHP cleans up after a fatal error, typically running out of memory: corrupted state from one request can be abused by the next request on the same worker. The result is memory disclosure, which can leak passwords, tokens and API keys, and when the two are chained, code execution without authentication.
The flaws were found by Wiz Research, which says AI models played a key role: Google's Gemini and OpenAI's GPT helped find the bugs, build the exploit and validate the patches. Wiz demonstrated the attack against current WordPress, Drupal and Joomla installs. It says every PHP version released in the last decade is affected, with the oldest vulnerable code going back to PHP 5.4.
The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For branches 7.4 to 8.1 the PHP security team published only minimal source patches, and older versions get no fix. If you use Linux distribution packages or shared hosting, you depend on your vendor to ship the update, so ask them.
Details leaked on Hacker News on 20 October, so PHP moved the release forward by a day. According to Tenable, Amazon saw an exploitation attempt as early as 17 October and has seen attacks from several groups since 21 October. Cloudflare has deployed WAF rules for known attack variants but calls them a stopgap. If you cannot update right away, Tenable lists temporary mitigations: disable session.upload_progress and adjust memory_limit, then restart PHP.
What it means for companies
If your website or online shop runs on WordPress or another PHP system, check your PHP version today and confirm with your host that the fix is in place. Because the flaw can leak passwords and keys from memory, rotate credentials after updating. Our website maintenance and cyber security services can patch and check your server. The case also shows that AI now finds vulnerabilities faster than people, on both sides, which is why every custom AI agent we build has permissions and oversight designed in from day one.
Sources: NÚKIB, Wiz Research, Tenable, CISA