October 22, 2026, saw millions of hackers attempt to take advantage of two major vulnerabilities in PHP. Governments and businesses had to take down some online systems while expert teams hurried to put in place emergency patches. This shows how little time have now been given to cybersecurity specialists to counter serious vulnerabilities.
Two 9.2-rated bugs that can hand over a server
The vulnerabilities, known together as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both have a critical severity score of 9.2 out of 10. On October 21, 2026, PHP released four fixes for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The UK’s NCSC says the bugs can corrupt PHP’s internal memory. Under certain conditions, an attacker could run code without logging in. Wiz also showed how sensitive data, including passwords and API keys, could leak from memory.
PHP powers 69.3% of websites with an identifiable server-side language, according to W3Techs. That shows how widespread PHP is, not how many sites were compromised.
The window between patch and exploit is closing
Frontier AI helped researchers piece together exploits for vulnerabilities buried in PHP for years. Cryptopolitan reported that the patches arrived a day ahead of schedule after technical details leaked.
Signs of the attack were visible before any attacks were reported. On October 17, 2026, four days before the disclosure, AWS identified the attempt in its MadPot honeypot logs. It is not known whether the attack was successful. AWS security chief CJ Moses warned threats could be created in hours or even minutes after the disclosure by attackers using AI.
Thousands of probes became millions in a day
Matthew Prince, CEO of Cloudflare, revealed that thousands of attempts were made in the 10 hours leading up to the disclosure on October 21. It did not take more than 45 minutes after that for the attempts to escalate to tens of thousands. In just two hours after that, the attempts crossed the hundreds of thousands mark. And soon after that, there were millions of attempts made. These were attempts, not confirmed breaches.
Cloudflare had already deployed firewall protection, but that was no substitute for patching.
On October 22, Reuters reported precautionary service suspensions at Nomura, Mitsubishi UFJ, ANA, East Japan Railway and Orange. Government websites also went temporarily offline in Finland, the Netherlands and France.
Finding every copy of PHP is the hard part
PHP can hide inside equipment that administrators rarely think to check. The Dutch NCSC’s inventory includes third-party products under review, among them Fortinet offerings. Searchlight Cyber released a scanner to identify vulnerable hosts. It deliberately tests memory exhaustion, so using it requires care.
PHP Foundation executive director Elizabeth Barron told WIRED:
To our knowledge, there has been no successful attempt at remote code execution.
Where the security spend is already heading
Gartner’s September 16 forecast puts global AI cybersecurity spending at $51.3 billion in 2026 and nearly $86 billion in 2027. It projects $2.7 trillion for worldwide AI spending in 2026.
PHP2Shell was not responsible for that forecasted expenses. Rather, this case is a great illustration of how important it is for firms to be aware of the software they run, to quickly patch vulnerabilities, and to detect threats long before their damaging effect is felt.
If you're reading this, you’re already ahead. Stay there with our newsletter.