PHP2Shell vulnerabilities trigger global security alerts

PHP2Shell CVE-2026-109618 remote code execution cybersecurity PHP vulnerabilities

Two critical vulnerabilities in the PHP programming language, nicknamed ‘PHP2Shell’ and identified as CVE-2026-109618 and CVE-2026-109619, have prompted urgent security warnings worldwide. These flaws allow unauthenticated remote code execution, meaning attackers can take control of web servers without needing a username or password.

The vulnerabilities were discovered with the assistance of artificial intelligence, highlighting a shift in the cyber threat landscape where AI accelerates both the identification and exploitation of software flaws. In response, the PHP Project released security patches on October 21, 2026, for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Impact has been felt globally, with some government agencies in Europe taking websites offline as a precaution. Security experts warn that while patching is essential, users of unsupported versions, such as PHP 8.1 or older, remain at significant risk as they no longer receive security updates. Organizations are advised to verify their server-level PHP versions, as updating CMS platforms like WordPress or Joomla alone may not resolve the underlying issue.

Entities

Amazon · CIRT · CVE-2026-109618 · CVE-2026-109619 · Calif · Cloudflare · Joomla · Ministry of Public Administration · NSA · National Security Agency · OpenAI · PHP

Claims

What the coverage asserts, and how many sources carry each claim.

[● 22 SOURCES] Two critical vulnerabilities have been identified in PHP, labeled CVE-2026-109618 and CVE-2026-109619. borba.me · www.gov.me · trn.mk · versloidejos.lt · www.infoq.com · +15 more
[● 9 SOURCES] Security fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. borba.me · www.gov.me · techfocus24.com · versloidejos.lt · www.osec.com · +4 more
[● 6 SOURCES] Amazon identified an attempt to exploit the security flaw four days before its official announcement. trn.mk · esgjournaljapan.com · www.machform.com · www.infoq.com · japan.zdnet.com · +1 more
[● 8 SOURCES] Vulnerabilities affect websites built on WordPress, Joomla, and Drupal platforms. borba.me · www.gov.me · www.machform.com · dev.to · ascii.jp · +3 more
[● 7 SOURCES] Updating a website platform or plugin does not necessarily update the PHP version on the server. borba.me · www.gov.me · techfocus24.com · dev.to · ascii.jp · +2 more
[● 10 SOURCES] Attackers can execute malicious code on a server without needing to log in to the system. borba.me · www.gov.me · techfocus24.com · versloidejos.lt · www.osec.com · +5 more
[● 5 SOURCES] PHP 8.1 and older versions are no longer under regular support. borba.me · www.gov.me · ascii.jp · www.machform.com · bimmae.com
[● 7 SOURCES] The PHP development team released security fixes on October 21. borba.me · www.gov.me · www.osec.com · www.machform.com · www.infoq.com · +2 more
[○ 1 SOURCE] OpenAI stated that findings of similar security flaws are likely to increase sharply in the coming months. www.governmentnews.com.au
[● 7 SOURCES] Security flaws in PHP potentially expose as many as 70 percent of websites. centrist.nz · www.governmentnews.com.au · lovendal.net · www.all-about-security.de · www.generation-nt.com · +2 more
[○ 1 SOURCE] A Chinese AI hacking tool called Artex has been used against hundreds of companies. centrist.nz
[○ 1 SOURCE] The market size for AI in cybersecurity is projected to reach $146 billion by 2032.