On October 21, the PHP team shipped an emergency patch, CISA told organizations to patch immediately, and the BBC reported websites going down worldwide for emergency maintenance. By the next day, Palo Alto Networks' Unit 42 was already seeing attacks in the wild. The cause: two memory-safety vulnerabilities in the core PHP engine, CVE-2026-109618 and CVE-2026-109619, collectively named PHP2Shell. Severity up to CVSS 9.2. Every PHP version released in the last decade is affected, back to 5.4.
PHP runs roughly 70% of all websites - WordPress, Drupal, Joomla, MediaWiki. The flaws are not in any application. They are in the language runtime underneath all of them.
What the bugs actually do
The technical core, in plain terms. Both CVEs are memory-safety bugs in how PHP handles fatal errors while processing a request, particularly out-of-memory conditions. When a request dies the wrong way, it can leave corrupted internal state behind. A later request - or another worker sharing the process - can reuse that stale state.
Two consequences follow. First, remote memory disclosure: an unauthenticated attacker can read the PHP worker's memory, which may contain passwords, authentication tokens, API keys and certificates from other requests. It is the same shape as Heartbleed, in a different runtime. Second, remote code execution: Wiz demonstrated pre-authentication RCE against WordPress, Drupal and Joomla, and was explicit that any PHP application is a valid target, because the vulnerable code is in PHP itself.
Every way of serving PHP is affected: Apache with mod_php (which PHP itself flags as highest risk), PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released October 21.
The part that should worry you even if you never touch PHP
Here is the detail that makes this week different from every other patch week. These bugs sat in the codebase for more than a decade. They were not secret, and they were not newly introduced. What was missing was an exploit, and building one required chaining multiple flaws while adapting to each target's memory layout through repeated testing and debugging. That was at the edge of what human researchers could practically do. So the bugs stayed theoretical.
Wiz Research closed that gap with three AI agents: Google's Gemini 4 Argon, OpenAI's GPT-5.6 Sol, and Wiz's own agent, Atlas. The agents helped identify the vulnerabilities, chain them, then test and debug working exploits across multiple applications - in hours, work the researchers say would previously have taken months.
Read that twice. The security of a large part of the web rested, in part, on the assumption that exploiting it was too tedious for anyone to bother. AI just removed tedium from the equation. "Too complex to exploit" is no longer a property you can rely on, for PHP or for anything else. Every old, stable, boring codebase just inherited a new threat model.
What to do this weekend
The checklist is genuinely short:
- Find every PHP runtime you depend on. Not just the code you write - your hosting, your CMS, your company's WordPress blog, the containers in your CI pipeline, that internal tool nobody has touched since 2019.
- Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Do not assume your distribution's package is current; check the actual version string.
- If you cannot patch immediately, the major edge providers prepared mitigations for exactly this case: Cloudflare, Akamai, Fastly, AWS, Google, Vercel and others shipped out-of-box protections during the coordinated disclosure. Turn them on.
- Treat it as urgent. At disclosure, CISA had not observed exploitation. Within a day, Unit 42 was reporting attacks in the wild. That gap is now measured in hours.
The uncomfortable conclusion
Your application code can be perfect and the runtime underneath it can still own you. Most of us inventory our dependencies; almost nobody inventories the language runtimes those dependencies stand on, or the ten-year-old assumptions inside them. This week is a good time to start.
The optimistic reading exists too. The same AI capability that made the exploit practical is what found the bugs in the first place, and the disclosure was coordinated, patched, and mitigated before mass exploitation. The defenders moved first this time. But the economics have permanently shifted: the cost of turning an old flaw into a working exploit has collapsed, and it is not going back up.
Top comments (1)
One of my hosters didn t even know about it... lol