Two critical security flaws in PHP, the programming language that runs much of the web, prompted an extraordinary warning on October 21, 2026: update immediately, or take your systems offline. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed "PHP2Shell," allow attackers to run commands on a server without logging in, according to the Associated Press-style reporting by Defense One.
The vulnerabilities were disclosed Wednesday morning after the PHP development team released emergency fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both flaws scored 9.2 on the CVSS severity scale, and PHP's maintainers warned there is no complete workaround other than updating, according to Defense One.
The U.S. National Security Agency, the FBI's cyber division, and the Cybersecurity and Infrastructure Security Agency issued a joint advisory telling organizations to patch at once or disconnect affected systems until they can. "These vulnerabilities often provide a direct path to the server's file system or database," the NSA's cyber unit wrote on X, according to The Hill. The U.K.'s National Cyber Security Centre issued its own warning the same day.
The exposure is enormous because PHP powers roughly 70 percent of websites whose server-side programming language can be identified, according to web technology tracker W3Techs, and sits at the core of popular platforms including WordPress, Drupal, Joomla, and Wikipedia's MediaWiki, The Hill reported. Palo Alto Networks' Unit 42 identified more than 22.6 million internet-exposed instances that might be vulnerable.
Artificial intelligence played a role in the discovery: security researchers working with an OpenAI initiative used the company's GPT-5.6 Sol model to find a version of the flaw, while the security firm Wiz independently discovered and reported both vulnerabilities, Reuters reported. Governments moved fast — Finland's government and the Dutch House of Representatives took websites offline, and Japan's prime minister issued a public warning urging website owners to prepare for the fix. Reuters also reported millions of hacking attempts tied to the flaws, while CISA said it had not observed successful exploitation as of its advisory.
What happens next is a race between administrators and attackers. Security researchers at WatchTowr were already tracking exploit attempts online as of October 22. Site owners who cannot patch — particularly those running end-of-life PHP 8.1 and older, which will receive no official fix — are being told to seek backports from their vendors or hosting providers, or stay offline until they can upgrade.
Tags
News