The Briefing:
- Two critical PHP flaws — CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell — were discovered in August 2026 by security firms Calif and Wiz using AI tools, then patched October 21 after details leaked a day ahead of schedule.
- A single unauthenticated HTTP request is enough to potentially seize a vulnerable server, setting off millions of attack attempts and forcing banks, airlines, railways, and government agencies across Asia and Europe to take services offline as a precaution.
- Administrators on supported PHP branches must update immediately to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35; servers still on end-of-life PHP 5.x or 7.x have no official fix available and should be disconnected from public networks without delay.
Two critical security flaws embedded inside PHP — the scripting language estimated to underpin roughly 70% of the world's websites, including major platforms built on WordPress and MediaWiki — have resurfaced this week in the most visible way possible: millions of attack attempts, emergency patches, and a cascade of precautionary shutdowns stretching from Tokyo to Amsterdam. The vulnerabilities, formally catalogued as CVE-2026-109618 and CVE-2026-109619 and grouped under the label PHP2Shell, had sat undetected inside production-level PHP code for years — until artificial intelligence tools gave human researchers the edge needed to unearth them.
A Single Request With No Password Required
Both flaws carry a CVSS v4.0 severity score of 9.2 out of 10, and they share a threat profile that makes defenders uneasy: an attacker holding no login credentials can send a single crafted HTTP request and potentially gain execution-level access to the affected server, before any application code has a chance to run its own authentication checks.
CVE-2026-109618 exploits how the PHP engine reacts when it runs out of memory during a request. The interruption leaves internal request data in a half-initialized state; PHP's cleanup routines then proceed to operate on that corrupted data as though it were trustworthy. CVE-2026-109619 takes a different path: request-owned internal state can persist after its backing memory has been freed, and a subsequent request processed by the same PHP worker may act on those stale values before normal initialization resets them. Together, the two CVEs affect the most widely deployed PHP configurations, including PHP-FPM and Apache servers running with mod_php.
AI Found What Human Auditors Had Overlooked for Years
The backstory behind PHP2Shell's discovery is at least as striking as the vulnerabilities themselves. Security firm Calif found the first flaw on August 1 using OpenAI's GPT-5.6 Sol as part of OpenAI's "Patch the Planet" security research initiative, reporting it to the PHP security team around August 11. Google-owned cybersecurity company Wiz independently reached the same codebase on August 19 using a combination of its own Wiz Atlas platform, Google's Gemini 4 Argon, and OpenAI's GPT-5.6 Sol, confirming unauthenticated code execution against Drupal the next day and WordPress the day after that. Wiz notified the PHP security team on August 24. In both cases, AI substantially compressed what would otherwise have been months of specialized manual work into a matter of days.
The PHP security team then worked with Calif, Wiz, Cloudflare, OpenAI, and Quarkslab to prepare a coordinated patch release, originally scheduled for October 22. That timeline was cut short when technical details of the vulnerabilities leaked online on October 20, forcing the release to move forward by a full day to prevent attackers from having an even wider window of undefended exposure.
From Scattered Probes to Millions of Attempts in Hours
The early exposure handed attackers a critical advantage. Amazon's MadPot honeypot network logged PHP2Shell exploitation attempts as early as October 17 — four days before the patch was publicly available — suggesting that details reached some threat actors through channels that remain unidentified.
Cloudflare began deploying web application firewall protections roughly nine hours before the official patch dropped. Cloudflare CEO Matthew Prince confirmed on X that exploitation attempts scaled sharply after the public announcement: tens of thousands of attempts appeared within 45 minutes of disclosure, the count climbed to hundreds of thousands within two hours, and total attempts reached into the millions by early October 22. Cloudflare CTO Dane Knecht, who tracked the WAF deployment in real time, noted that attackers were continuously adapting their payloads to bypass each new defensive rule as it was deployed.
Separately, security researchers at Sophos identified attempts to use PHP2Shell as a delivery mechanism for Potassium, a Mirai-derived botnet variant first flagged in early 2026. The attempt Sophos analyzed was blocked before the payload reached its intended target; examination of the captured sample showed an updated, significantly expanded version capable of downloading additional malware and launching distributed denial-of-service attacks. As of publication, no government officials in Germany, the Netherlands, or Japan have confirmed a successful compromise through these vulnerabilities.
Services Go Dark From Tokyo to Amsterdam
Japan recorded some of the most visible real-world fallout. Mizuho Bank, Mitsubishi UFJ Morgan Stanley Securities, and Shizuoka Bank suspended portions of their online platforms; All Nippon Airways paused certain app features; Japan Airlines took down segments of its corporate and reservation sites; and both East Japan Railway and the National Tax Agency moved services offline. Prime Minister Sanae Takaichi issued an urgent public post on X calling on website operators to apply the fix immediately upon release, adding that her own office had taken its website down and stating that temporarily shutting down a site could be an essential security response depending on the circumstances.
Across Europe, the disruptions touched nearly every sector. The Netherlands saw some of the widest impact: the Dutch National Cyber Security Centre took its own site offline, followed by the MijnOverheid citizen portal, the House of Representatives website, the Port of Rotterdam, and several hospital sites. Finland's state IT provider Valtori shut down government public-facing web services as a precaution and confirmed no breach had occurred. France's Interior Ministry disconnected local government administrative sites while awaiting the patch; other French services that went dark included the Finance Ministry portal and Météo-France. Orange separately took some PHP-based services offline for emergency patching — a step distinct from the major mobile network outage the carrier experienced the same day, which Orange attributed to equipment failure in its new mobile core and explicitly denied any connection to PHP2Shell.
Denmark's municipal IT body Kombit shut down several services, including the national school communication platform. Belgium's foreign ministry took its websites offline following reports of attack activity, though Belgium's national cybersecurity centre stated it had recorded no successful attacks on Belgian infrastructure. Canada's Cyber Centre and Australia's cybersecurity agency both issued advisories urging organizations to patch or take vulnerable systems offline without delay, while confirming no successful exploitation had been detected at the time of publication.
What Administrators Must Do Now
The PHP project released patched versions on October 21: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 each close both CVEs. Any administrator running one of these supported branches should treat the update as urgent and apply it immediately. The picture is considerably more difficult for servers still operating on PHP 5.x or 7.x — both branches are beyond their end-of-life and will receive no official fix. Security agencies across multiple countries have recommended isolating those systems from public-facing networks as the only near-term mitigation available.
In Spain, the Instituto Nacional de Ciberseguridad issued a critical-level advisory — the highest tier on its alert scale — calling on organizations to apply the patches at once or, where an immediate update is not feasible, to cut off public network access to any exposed servers pending remediation.
PHP2Shell has reignited a structural debate within the security community: the broader internet is built on a remarkably thin layer of shared infrastructure, and when one piece of that layer carries a critical, universally exploitable flaw, the consequences radiate instantly across industries, borders, and sectors. The episode illustrates both the promise of AI-assisted security research — two teams found in days what manual audits had missed for years — and its darker implication: those same tools are now being used to build the attacks that follow.
© {{Year}} Latin Times. All rights reserved. Do not reproduce without permission.