Two dormant vulnerabilities in the PHP programming language nearly disrupted global internet infrastructure on Wednesday, October 21, 2026, after researchers devised a method to exploit them without credentials. Designated as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, the remote code execution flaws forced major web hosts, banks, and retailers to pull servers offline for emergency patching, TechCrunch reported.
While industry-wide coordination helped avoid a catastrophic systemic collapse, security researchers warn that the crisis is far from over as unpatched servers remain exposed to data theft and malware installation.
How Calif Researchers Uncovered PHP2Shell and OpenAI Collaboration
Security researchers at Calif originally discovered the two bugs in 2024 during a code audit, though teams did not consider them exploitable at the time and left them unpatched. Calif later participated in the Hack the Planet initiative hosted by OpenAI and cloud security giant Wiz, where researchers used AI assistance to help map out exploit vectors. Wiz subsequently verified the proof-of-concept exploits developed by Calif.
Update: Our PHP exploit is now production-grade.* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load* ARM64 + x86-64 targets* MediaWiki, WordPress, phpBB, Laravel* Apache/mod_php and nginx/php-fpm -> roothttps://t.co/vXQjheyp20 pic.twitter.com/CAF1htNW0o
Calif alerted the PHP Foundation, which manages the open-source language. The foundation established a tightly guarded embargo to distribute patches confidentially to major internet companies and web hosts, granting them a head start before public disclosure on Wednesday.
Why Unauthenticated Remote Code Execution Threatens PHP Servers
PHP2Shell allows unauthenticated remote code execution, granting external attackers full control over vulnerable online systems without requiring a password, user interaction, or downloaded files. This vulnerability poses severe risks because PHP underpins approximately 70% of web-facing internet infrastructure, powering popular content management systems such as WordPress, Drupal, Joomla, and Wikipedia’s MediaWiki.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Amazon reported detecting active exploitation of the flaws as early as October 17, roughly a week before patches became publicly available. Security giants Palo Alto Networks and Trail of Bits confirmed post-exploit activity and compromises targeting unpatched systems late Friday.
Impact on Global Infrastructure and Legacy Systems
The sudden disclosure triggered widespread defensive shutdowns across critical sectors, including healthcare networks, financial institutions, and educational platforms like the Smartschool system in Edegem. Matthew Prince, chief executive of Cloudflare, reported an exponential surge in exploitation attempts following the patch release.
PHP usage extends beyond web servers into developer command-line packages, routers, storage devices, firewalls, and VPN hardware. Because PHP is a memory-unsafe language—a category responsible for approximately 75% of actively exploited vulnerabilities according to the National Security Agency—security analysts expect the fallout from legacy software dependencies to persist for years.
Frequently Asked Questions About PHP2Shell
Did AI discover the PHP2Shell vulnerabilities?
Security researchers at Calif discovered two bugs in PHP earlier this year as part of a security audit of PHP’s code.
Why were the vulnerabilities exploited before the patch release?
Amazon detected exploitation attempts as early as October 17, approximately one week before the PHP Foundation publicly released patches. The PHP Foundation attributed part of the early leakage to a company pushing patches live hours before the embargo expired.
Which major platforms and technologies rely on PHP?
Roughly 70% of the web-facing internet relies on PHP, including content management platforms like WordPress, Drupal, Joomla, and MediaWiki, which powers Wikipedia. The language also appears in developer command-line tools and enterprise hardware like routers and firewalls.
More on Hack the Planet
Worth a look