php2shell: Two Critical PHP Flaws With 9.2 Severity Force Emergency Patches and Precautionary Government Site Shutdowns
The PHP Foundation shipped emergency fixes for two 9.2-severity remote code execution flaws dubbed "php2shell," discovered partly with AI tools, after details leaked early and attacks began emerging. Government sites in Finland, France and the Netherlands went offline as a precaution, with over 1.9 million exposed PHP hosts in scope.
What happened
On Wednesday, October 21, 2026, the PHP Foundation released emergency security updates fixing two critical remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed "php2shell" by researchers. Both flaws carry a 9.2 out of 10 rating on the CVSS v4.0 severity scale, and the patches shipped just before 10 a.m. ET after details leaked ahead of the coordinated disclosure, prompting the Foundation to accelerate its rollout. The vulnerabilities affect "all PHP installations serving web requests" going back to PHP 5, which was released in July 2004, though only PHP 8.2 and newer are supported and receive fixes: the patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to WIRED.
The timeline was compressed and contested. Cloudflare CTO Dane Knecht reported "seeing early attacks emerging" before the official release, and the company deployed WAF protections at 3:02 a.m. UTC on October 21, roughly nine hours ahead of the public disclosure. Cloudflare also observed attackers mutating their payloads to evade its rules. Sansec had warned ahead of the fixes: "We expect mass attacks to start within 15 minutes of the release." The Foundation had posted advance notice on October 20, 2026.
The consequences were visible quickly. Multiple Finnish government sites, including the National Land Survey, went offline as a precaution, along with French government websites, the Port of Rotterdam and sites in the Netherlands. Wiz researchers wrote that the flaws can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory that "may contain passwords, authentication tokens, API keys and certificates."
Why it matters
The exposure is unusually broad. Tenable cited a Shodan search by Henk Poley counting more than 1.9 million internet-exposed PHP hosts, while the ground.news summary cites more than 1.3 million hosts at risk and up to 70 percent of the world's websites potentially affected. Sansec said the bugs affect Magento, Shopware and WooCommerce stores, which puts a large share of online commerce infrastructure in scope alongside government and public-sector sites.
The technical character of the flaws is what has drawn the sharpest warnings. Independent security consultant Lukasz Olejnik of King's College London said "This is not a drill" and warned that the worst case is "wormable malware affecting big chunks of the internet." Consultant Davi Ottenheimer described the file-upload flaw as "a front door with no lock." Because the vulnerabilities permit unauthenticated code execution, an attacker needs no credentials to compromise a vulnerable server, which is what makes a self-spreading worm scenario plausible in the eyes of the researchers quoted.
The Foundation's own guidance underlines the severity. It advised that "There are no complete mitigations, updating is the only safe choice," and listed partial mitigations including memory_limit=-1, lowering post_max_size, and setting session.upload_progress.enabled=0, while stating that these "do not make an installation safe." For operators running PHP versions older than 8.2, which no longer receive patches, the only path to a fix is an upgrade of the runtime itself, a heavier task than applying a point release.
The role of AI tools in the discovery is also notable for the security industry. Wiz said its researchers used AI tools partially in finding the flaws, and OpenAI's involvement as an independent discoverer marks a high-profile case of AI-assisted vulnerability research reaching critical infrastructure software.
How it is being covered
Ground.news counts 170 sources carrying the story, with a left/centre/right split of 28/30/42 percent, and 36 of 65 rated outlets at high factuality plus 18 at very high factuality. The blindspot check shows no gap, meaning no side of the political spectrum is missing the story. Coverage across the range focuses on the emergency patching and the precautionary shutdowns of government sites rather than on partisan framing, per ground.news figures.
What to watch
Watch for mass scanning and exploitation attempts in the days after the October 21 release, given Sansec's forecast of attacks within 15 minutes and Cloudflare's report of early attacks already emerging. Watch whether the Foundation or researchers confirm any wormable malware in the wild, the scenario Olejnik flagged as the worst case. Watch for further precautionary outages among government and e-commerce operators running Magento, Shopware or WooCommerce, and for disclosure of how the pre-release leak occurred. Watch also for any statement on the share of the 1.9 million exposed hosts that remain unpatched, since PHP versions older than 8.2 have no fix available.
By the numbers
Source snapshot
