[CLSTR]
< Back to situation

[REVISION HISTORY]

PHP security vulnerabilities discovery and patching

Updated 2 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-25 11:44 UTC → 2026-10-25 15:21 UTC · added removed

A critical security vulnerability in the PHP programming language, referred to as ‘PHP2Shell’, was identified using artificial intelligence. The flaws, designated as CVE-2026-109618 and CVE-2026-109619, received a CVSS 4.0 score of 9.2 and affect the PHP engine’s memory management and internal processing. Researchers from companies such as Calif Calif, Wiz, and Wiz Amazon utilized AI to find these flaws, while the PHP Foundation collaborated with OpenAI to examine code. Because PHP powers approximately 70 percent of the world’s websites, including major platforms like WordPress and Drupal, the discovery triggered a global cybersecurity alert. Michael Daniel of the Cyber Threat Alliance described the situation as the start of a ‘chaotic period’ due to the increasing ability of AI to find hidden flaws at scale. The vulnerabilities could allow unauthenticated attackers to achieve remote code execution (RCE), potentially granting access to server file systems and databases. In response, the US National Security Agency and the UK’s NCSC urged organizations to take websites offline if patches cannot be applied immediately. The government of Mauritius proactively took approximately 70 percent of its government websites offline to protect citizen data, while in the UAE, an estimated 4,691 internet-facing hosts—representing 79.5 percent of the country’s versioned hosts—are potentially exposed. While CrowdStrike has not observed noted that widespread, successful exploitation in has been difficult to achieve due to the wild, experts warn of a potential ‘deluge technical complexity of flaws’ as AI tools accelerate weaponizing the scanning of legacy code. Developer Remi Collet bugs, some reports indicate that exploitation attempts may have begun as early as October 17. The PHP Foundation released vital updates to PHP archives patches on October 21 to address the vulnerabilities.

Versions

  1. 2026-10-25 15:21 UTC PHP security vulnerabilities discovery and patching
  2. 2026-10-25 11:44 UTC PHP security vulnerabilities discovery and patching
  3. 2026-10-25 09:36 UTC PHP security vulnerabilities discovery and patching

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.