PHP Rushes Emergency Patches for Critical ‘PHP2Shell’ Flaws as Exploitation Wave Targets Global Web Infrastructure

The internet's baseline web plumbing is facing a widespread security scramble following the disclosure of PHP2Shell, a pair of critical zero-day vulnerabilities in the PHP runtime that permit unauthenticated remote code execution.

Tracked as CVE-2026-109618 and CVE-2026-109619, both carry a CVSS v4.0 severity rating of 9.2. Discovered jointly by researchers at Wiz, Calif, and OpenAI's Codex Security team—collaborating with Google's Gemini unit and PHP maintainers—the vulnerabilities trace back through core PHP code dating as far back as PHP 5.4.

The release of official patches was pulled forward to October 21 after exploit details and proof-of-concept demonstrations leaked prematurely across community channels and vendor container registries.

Deep Runtime Flaws Expose Web Engines Unlike typical application vulnerabilities in frameworks like WordPress, Drupal, or Laravel, PHP2Shell sits inside the underlying C-based PHP interpreter. As a result, updating CMS or framework dependencies does nothing to mitigate the threat:

• Universal Exposure: Any web server environment handling PHP requests—including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed—is susceptible. Even an empty "Hello World" script can be leveraged to compromise the host.

• Apache mod_php Under Fire: Apache servers utilizing mod_php represent the highest operational danger, where a single malicious HTTP request triggers arbitrary code execution before application code or routing layers ever run.

• Worker Memory Leaks: Attackers can read live heap memory directly from running PHP worker processes, enabling them to harvest cleartext session tokens, database passwords, and API credentials from other concurrent requests without needing full shell access.

The AI-Accelerated Exploit Breakthrough The flaws illustrate a watershed moment in automated vulnerability discovery:

• Decade-Old Blindspot: First spotted as an unresolved memory-management quirk during an audit in 2024, the issue languished due to maintainer disagreements over potential performance and backward-compatibility breakages.

• The AI Difference: Using advanced frontier reasoning models, a single security researcher mapped and operationalized an end-to-end working exploit chain within seven days—a breakthrough that historical manual audit teams had failed to construct over two decades.

"The only thing I can say is that the only mitigation is patching/upgrading PHP. I sadly know too much." — Gina Peter Banyard, PHP Core Developer

Precautionary Blackouts and Early Exploitation As cyber-intelligence firms like watchTowr and Cloudflare confirm live scans and payload adaptation in the wild, several enterprise and public services preemptively pulled infrastructure offline to patch:

• **Enterprise Service Halts: HR and payroll provider BambooHR temporarily shuttered services across North America and Europe, pausing scheduled wage distributions to apply server-level patches.

• Government Portals Down: In the Netherlands, citizen identification systems including DigiD, the parliamentary website, and national educational directories went offline in precautionary emergency maintenance windows.

Remediation Guidance System administrators must immediately upgrade underlying server packages to:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Because PHP 8.1 and earlier branches have reached end-of-life status, backported source diffs have been issued for legacy 7.4 through 8.1 branches. System engineers are instructed to immediately bounce all PHP-FPM workers, restart web server daemons, and inspect access logs for abnormal multipart payloads or recurring 500 error spikes.