# Global impact and government responses to PHP2Shell > Live situation record from CLSTR: https://clstr.news/situations/20261023-php-programming-language-security-vulnerabilities > Updated: 2026-10-26T10:15:56.000Z. Sources: 204. Developments: 6. The security crisis surrounding the PHP vulnerabilities known as ‘PHP2Shell’ (CVE-2026-109618 and CVE-2026-109619) has escalated into a global cybersecurity emergency. These flaws, carrying a severity rating of 9.2 out of 10, allow for unauthenticated remote code execution (RCE). Security researchers from Palo Alto Networks and Trail of Bits have confirmed successful exploitation on live targets, while Amazon reported detecting attempts four days prior to official disclosure. The impact is widespread due to PHP powering an estimated 69% to 75% of websites with identifiable server-side technology, including platforms like WordPress and Drupal. In Brazil, the vulnerabilities prompted the preventive shutdown of several government systems, including federal courts and Anatel. In Ghana, the CSA and NITA issued urgent directives requiring government institutions to patch systems within seven days. Previously, telemetry recorded millions of exploitation attempts, including Mirai botnet deployments and a breach of a European government agency involving password hashes and MFA secrets. A new RCE vulnerability, CVE-2026-115560, was also identified affecting specific ‘session.serialize_handler’ configurations. While the PHP project released patches on October 21, 2026, for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, users on PHP 8.1 or older remain at risk as those versions no longer receive official security updates. In Italy, CERT-AGID identified at least 650 potentially vulnerable URLs within the Index of Public Administrations. By late October, the crisis has been described by some as ‘Black October,’ a period marked by a massive wave of cybersecurity incidents. Beyond PHP, high-severity flaws were identified in Node.js, Java, GitLab, Railway, WordPress, and the AI tool LiteLLM. Security experts warn that automated AI agents are actively scanning for these vulnerabilities to launch attacks, and the vast scale of the issue leaves many sites and datasets potentially exposed during the patching process. ## Claims - Two critical vulnerabilities were discovered in the PHP programming language. (corroborated by 38 sources) - The vulnerabilities allow for unauthenticated remote code execution. (corroborated by 36 sources) - PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been identified. (corroborated by 33 sources) - The PHP Foundation has released corrected versions of the language. (corroborated by 26 sources) - PHP powers approximately 70% of all websites globally. (corroborated by 22 sources) - Security patches were released for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. (corroborated by 21 sources) - The vulnerabilities were discovered with the assistance of artificial intelligence. (corroborated by 15 sources) ## Timeline ### 2026-10-26: CERT-AGID identifies 650 potentially vulnerable Italian public administration URLs CERT-AGID has flagged 650 Italian public administration URLs as potentially vulnerable to the PHP2Shell exploit, urging immediate patching to prevent unauthenticated remote code execution. 2 sources. https://clstr.news/cluster/cert-agid-identifies-650-potentially-vulnerable-italian-public-administration-urls ### 2026-10-25: PHP security vulnerability threatens global websites A critical PHP vulnerability threatens nearly one-third of global websites, as many run on unsupported versions. South Korean authorities are coordinating with hosting providers to assist vulnerable SMEs. 4 sources. https://clstr.news/cluster/php-security-vulnerability-threatens-global-websites ### 2026-10-25: Global cybersecurity crisis dubbed ‘Black October’ targets core web technologies A surge of over 27 major cybersecurity incidents, dubbed ‘Black October,’ has targeted core technologies like PHP, Node.js, and Java, putting much of the web at risk. 2 sources. https://clstr.news/cluster/global-cybersecurity-crisis-dubbed-black-october-targets-core-web-technologies ### 2026-10-23: PHP security vulnerabilities trigger widespread warnings for web operators Critical PHP vulnerabilities have prompted experts to urge web operators to perform retroactive log audits and credential renewals beyond simple software patching to mitigate active exploitation risks. 14 sources. https://clstr.news/cluster/php-security-vulnerability-prompts-urgent-expert-warnings ### 2026-10-23: PHP vulnerabilities trigger global cybersecurity alerts Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution, affecting up to 75% of the web and forcing government shutdowns in some regions. 183 sources. https://clstr.news/cluster/php-vulnerabilities-cause-service-suspensions-in-brazil ### 2026-10-22: Critical PHP vulnerabilities trigger global security responses Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allowing remote code execution have prompted global security measures and emergency patching. 4 sources. https://clstr.news/cluster/cybersecurity-concerns-rise-over-critical-infrastructure-and-php-vulnerabilities --- Cite as: Global impact and government responses to PHP2Shell. CLSTR, https://clstr.news/situations/20261023-php-programming-language-security-vulnerabilities