New to this? Read it in simple words
- PHP runs a large share of websites, and it had two serious flaws.
- Attackers who are not logged in could run their own code on a server.
- Security firms used AI tools to show how the flaws could be used.
- Some government websites in Europe went offline until they were fixed.
- PHP
- A programming language that builds web pages on a server before they reach your browser.
- CVE
- A public number that names one security flaw, so everyone can talk about the same problem.
- Firewall
- A filter in front of a website that blocks requests that look like attacks.
PHP is a free, open-source programming language that runs a large share of the web, including WordPress, Drupal and Joomla sites. On Wednesday, October 21, its makers released urgent fixes for two flaws that security firms nicknamed “PHP2Shell”.
Two flaws in the heart of PHP
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS scale.
Both sit in memory handling and error handling, parts of PHP that nearly every web request touches. Under the right conditions, an attacker who is not logged in can run their own code on the server, the PHP Foundation says.
PHP 8.1 and older no longer get regular updates. Because the flaws are so serious, PHP’s security team also published small fixes for PHP 7.4, 8.0 and 8.1. It urges everyone to update now.
From the PHP Foundation’s account and Wiz’s research.
How AI helped find them
A PHP core developer saw the first signs of one flaw in 2024, during an outside audit. The team could not agree on a fix, and the work stalled for months. The PHP Foundation calls the delay “a structural failure”.
On August 11, researcher Ryan A at the security firm Calif reported a way to take over servers through the same flaw. OpenAI reported the same root cause on the same day, and Wiz reported more ways in on August 24.
Wiz says its research used its own AI tool, Wiz Atlas, with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Calif’s audit was sponsored by OpenAI as part of a programme called Patch the Planet, heise reports.
AI tools also bring PHP far more bug reports. Its security team has published 15 CVEs since July 1 and turned away more than 100 reports that were invalid, repeated or could not be reproduced.
Websites taken offline
The fixes came a day early, because the two CVE numbers leaked online on October 20. No technical details leaked with them, the PHP Foundation says.
PHP runs about 75% of websites whose language can be identified, W3Techs says. In the Netherlands, the national cyber security centre took its own website offline as a precaution, Reuters reports. The Port of Rotterdam, the government portal Overheid.nl and several hospital websites followed. Finland’s state IT provider and France’s Interior Ministry also took sites down or into maintenance.
Cloudflare says it added protective firewall rules for every plan that uses its firewall, including free ones, and that it saw attack traffic. Heise reported that no use by criminals was known yet.
Experts quoted by Reuters fear that AI tools will help attackers study the public fix and strike quickly. Small websites on shared hosting may stay exposed the longest.
Sources
Every fact in this story comes from the sources below. Open them to check our work.
- 1Primary source · October 21, 2026Security advisory: Critical remote code execution vulnerabilities, update now PHP
- 2Primary source · October 21, 2026Today’s PHP Security Release, and How We’re Strengthening PHP Security The PHP Foundation
- 3Primary source · October 21, 2026PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet Wiz
- 4Primary source · October 21, 2026Cloudflare deploys protections against php2shell vulnerability Cloudflare
- 5Research · October 21, 2026European government websites go dark as software flaw sparks security scramble Reuters (via ARN News)
- 6Research · October 21, 2026php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP heise online
- 7Research · October 21, 2026PHP ships emergency patches for critical PHP2Shell flaws BleepingComputer
Who found what, and when, comes from the PHP Foundation and Wiz. Whether attackers already use the flaws is unclear: Cloudflare says it saw attack traffic, while others knew of no criminal use yet.
Two critical PHP flaws let attackers run code on web servers, pushing European governments to take sites offline, though fixes are out. How we rate the mood