Two serious vulnerabilities in PHP, one of the most widely used programming languages for websites, have raised concerns across the global technology industry. The flaws, identified as PHP2Shell and assigned the identifiers CVE 2026 109618 and CVE 2026 109619, could allow attackers to gain unauthorised access to vulnerable systems without requiring login credentials.
The vulnerabilities became public on October 21, 2026, when the PHP Foundation released security patches to address the risks. Although the flaws had been identified in 2024, researchers had not initially established a practical way to exploit them. New research changed that assessment, turning what had appeared to be dormant software weaknesses into a serious security concern.
The discovery triggered an urgent response from technology companies, hosting providers and organisations that depend on PHP powered websites. Some businesses temporarily took their services offline while they worked to secure their infrastructure. Banks, retailers, hospitals, gaming platforms and government organisations were among the sectors facing pressure to assess their exposure.
Despite the widespread concern, the situation did not immediately develop into a global wave of successful attacks. Coordinated security efforts helped many organisations prepare patches before the vulnerabilities became public. However, security researchers warned that the threat had not disappeared, particularly because many internet connected systems remained unpatched.
Why the PHP2Shell flaws are particularly dangerous
PHP2Shell is especially concerning because the vulnerabilities could enable remote code execution. This type of security flaw allows an attacker to execute commands on a vulnerable system over a network, potentially gaining extensive control over the affected machine.
The lack of an authentication requirement makes the situation more serious. Attackers would not necessarily need a valid username, password or direct access to a target’s network to exploit an exposed and vulnerable system.
Once inside, a malicious actor could potentially install malware, steal sensitive information, modify website content or establish persistent access for future attacks. The consequences would depend on the affected system’s configuration, permissions and the security measures already in place.
PHP’s widespread adoption adds another layer of risk. The language remains a major part of the infrastructure supporting websites and online services. Popular platforms such as WordPress, Drupal and Joomla rely on PHP in various parts of their ecosystems, making the security of the underlying software important for businesses and website owners alike.
However, the presence of PHP does not automatically mean that every website built with these platforms is vulnerable. Exposure depends on the affected PHP components, software versions, deployment configurations and whether the necessary security updates have been installed.
For administrators, the immediate priority is to identify systems running affected versions, apply the official patches and investigate any signs of unauthorised activity.
How researchers and AI helped uncover the security weaknesses
The vulnerabilities were discovered by researchers at Calif during a security review of PHP’s code. Their work formed part of Hack the Planet, an initiative involving OpenAI and cloud security company Wiz.
According to the researchers’ account, AI tools assisted with parts of the exploitation process. However, the discovery was not simply the result of asking an AI model to find security bugs. The team relied heavily on its existing knowledge of PHP’s codebase, previous exploitation techniques and the behaviour of the underlying software.
Wiz subsequently helped verify the proof of concept exploits developed by the researchers.
The episode highlights the growing role of AI in cybersecurity. Modern AI systems can help security specialists analyse large codebases, investigate unusual behaviour and explore potential weaknesses more efficiently. They can also assist defenders in understanding how a vulnerability might be abused and how best to mitigate it.
However, AI is not a substitute for experienced security researchers. Finding a weakness, demonstrating that it can be exploited and developing a reliable attack method are separate challenges. Human expertise remains essential when interpreting results, validating findings and determining the real world impact of a vulnerability.
The same technology could also benefit attackers by reducing the time and effort needed to investigate publicly available software. This creates a growing challenge for developers and security teams, who must find and fix weaknesses before malicious actors can take advantage of them.
Early exploitation raises questions about software security
Although the PHP Foundation coordinated the disclosure process to give major companies time to prepare, there were indications that attackers had begun exploiting the vulnerabilities before the patches were publicly released.
Amazon reported detecting suspicious exploitation activity approximately a week before the official fixes became available. Its observations suggested that at least one attacker may have discovered a working exploitation method before the public disclosure.
Several explanations remain possible. Attackers could have discovered the vulnerabilities independently, obtained information through a leak or gained early knowledge of the patches. Changes to open source code can also reveal useful details about a vulnerability once a fix becomes publicly available.
The PHP Foundation reportedly raised concerns about one organisation releasing patches before the agreed disclosure deadline. However, that incident alone does not explain the earlier activity identified by Amazon.
By October 23, security companies Palo Alto Networks and Trail of Bits had also reported confirmed compromises and malicious activity associated with PHP2Shell. The affected targets and the full extent of the incidents remained unclear in the supplied reporting.
These developments demonstrate why installing a patch should not be treated as the end of an organisation’s response. If attackers gained access before a fix was applied, updating the software may not remove malware, reverse data theft or eliminate unauthorised accounts.
Organisations should therefore review server logs, investigate suspicious processes, check for unexpected changes and follow relevant security advisories. Where there is evidence of a compromise, incident response procedures may be necessary alongside patching.
The incident also exposes a longstanding weakness in the open source ecosystem. Critical software can support a huge share of the internet while being maintained by relatively small teams with limited resources. Companies may depend on these projects without contributing enough funding or engineering support to ensure that they receive regular security reviews.
PHP2Shell is a reminder that maintaining the internet’s underlying software requires more than releasing emergency patches after a crisis begins. Long term investment, responsible disclosure, timely updates and better security monitoring are all essential.
Follow TechBSB For More Updates
