PHP security vulnerabilities discovery and patching

A critical security vulnerability in the PHP programming language, referred to as ‘PHP2Shell’, was identified using artificial intelligence. The flaws, designated as CVE-2026-109618 and CVE-2026-109619, received a CVSS 4.0 score of 9.2 and affect the PHP engine’s memory management and internal processing. Researchers from companies such as Calif, Wiz, and Amazon utilized AI to find these flaws, while the PHP Foundation collaborated with OpenAI to examine code.

Because PHP powers approximately 70 percent of the world’s websites, including major platforms like WordPress and Drupal, the discovery triggered a global cybersecurity alert. Michael Daniel of the Cyber Threat Alliance described the situation as the start of a ‘chaotic period’ due to the increasing ability of AI to find hidden flaws at scale. The vulnerabilities could allow unauthenticated attackers to achieve remote code execution (RCE), potentially granting access to server file systems and databases.

In response, the US National Security Agency and the UK’s NCSC urged organizations to take websites offline if patches cannot be applied immediately. The government of Mauritius proactively took approximately 70 percent of its government websites offline to protect citizen data, while in the UAE, an estimated 4,691 internet-facing hosts—representing 79.5 percent of the country’s versioned hosts—are potentially exposed. While CrowdStrike has noted that widespread, successful exploitation has been difficult to achieve due to the technical complexity of weaponizing the bugs, some reports indicate that exploitation attempts may have begun as early as October 17. The PHP Foundation released vital patches on October 21 to address the vulnerabilities.