- AI-assisted research exposed two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution and memory disclosure, and PHP patched them on October 21.
- Cloudflare logged millions of attack attempts and governments and companies worldwide pulled services offline, though the PHP Foundation says no successful code execution is known.
- AI is now compressing the time between disclosure and working exploits, pressuring anyone running PHP to patch in hours, not days.
October 22, 2026, saw millions of hackers attempt to take advantage of two major vulnerabilities in PHP. Governments and businesses had to take down some online systems while expert teams hurried to put in place emergency patches. This shows how little time have now been given to cybersecurity specialists to counter serious vulnerabilities.
Two 9.2-rated bugs that can hand over a server
The vulnerabilities, known together as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both have a critical severity score of 9.2 out of 10. On October 21, 2026, PHP released four fixes for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The UK’s NCSC says the bugs can corrupt PHP’s internal memory. Under certain conditions, an attacker could run code without logging in. Wiz also showed how sensitive data, including passwords and API keys, could leak from memory.
PHP powers 69.3% of websites with an identifiable server-side language, according to W3Techs. That shows how widespread PHP is, not how many sites were compromised.
The window between patch and exploit is closing
Frontier AI helped researchers piece together exploits for vulnerabilities buried in PHP for years. Cryptopolitan reported that the patches arrived a day ahead of schedule after technical details leaked.
Signs of the attack were visible before any attacks were reported. On October 17, 2026, four days before the disclosure, AWS identified the attempt in its MadPot honeypot logs. It is not known whether the attack was successful. AWS security chief CJ Moses warned threats could be created in hours or even minutes after the disclosure by attackers using AI.
Thousands of probes became millions in a day
Matthew Prince, CEO of Cloudflare, revealed that thousands of attempts were made in the 10 hours leading up to the disclosure on October 21. It did not take more than 45 minutes after that for the attempts to escalate to tens of thousands. In just two hours after that, the attempts crossed the hundreds of thousands mark. And soon after that, there were millions of attempts made. These were attempts, not confirmed breaches.
Cloudflare had already deployed firewall protection, but that was no substitute for patching.
On October 22, Reuters reported precautionary service suspensions at Nomura, Mitsubishi UFJ, ANA, East Japan Railway and Orange. Government websites also went temporarily offline in Finland, the Netherlands and France.
Finding every copy of PHP is the hard part
PHP can hide inside equipment that administrators rarely think to check. The Dutch NCSC’s inventory includes third-party products under review, among them Fortinet offerings. Searchlight Cyber released a scanner to identify vulnerable hosts. It deliberately tests memory exhaustion, so using it requires care.
PHP Foundation executive director Elizabeth Barron told WIRED:
To our knowledge, there has been no successful attempt at remote code execution.
Where the security spend is already heading
Gartner’s September 16 forecast puts global AI cybersecurity spending at $51.3 billion in 2026 and nearly $86 billion in 2027. It projects $2.7 trillion for worldwide AI spending in 2026.
PHP2Shell was not responsible for that forecasted expenses. Rather, this case is a great illustration of how important it is for firms to be aware of the software they run, to quickly patch vulnerabilities, and to detect threats long before their damaging effect is felt.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
What is PHP2Shell?
PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10, that can let an unauthenticated attacker run code on servers or read sensitive process memory such as passwords and API keys.
How quickly did attacks ramp up after disclosure?
Cloudflare CEO Matthew Prince said the network saw thousands of exploitation attempts in the 10 hours before public announcement, tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions afterward.
Have any systems actually been breached?
No confirmed compromise has been established. AWS says it detected an exploitation attempt dated October 17 but cannot confirm it succeeded, and the PHP Foundation says it knows of no successful remote code execution.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Ibiam Wayas
Ibiam Wayas has covered the crypto news beat since 2019. He studied Computer Science at National Open University of Nigeria. His work has appeared on various crypto news platforms, including Coinfomania, Crypto News Australia, and AltcoinBuzz. Drawing on his background in Computer Science, he now focuses on crypto, robotics, and longevity news.
