PHP2Shell Bugs Let Attackers Run Code Without Logging In
Two critical remote code execution flaws in the PHP language behind WordPress and most of the web have been fixed as of October 21, 2026, and the FBI and NSA issued urgent alerts urging operators to patch or take vulnerable servers offline. Researchers at Wiz and OpenAI found the pair using AI tooling, and defenders have already observed exploitation in the wild. Named PHP2Shell, the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Here is what they do, who is exposed, and what to check first.
Key Takeaways:
- – Two unauthenticated remote code execution bugs in PHP core, CVE-2026-109618 and CVE-2026-109619, were fixed on October 21, 2026.
- – Both flaw pair affects PHP 5.4 and later releases going back more than a decade of supported builds.
- – Evidence of exploitation exists publicly, and Palo Alto Unit 42 observed an agentic AI attacker chain exploiting a target within hours of the advisory.
- – Firewall telemetry identified more than 22.6 million exposed instances potentially vulnerable worldwide.
- – The FBI and NSA warned on Wednesday that hackers could seize control of websites, and at least one European government took its site offline as a precaution.
What PHP2Shell actually is
PHP2Shell is a pair of bugs in PHP itself rather than in a single plugin or framework. Sansec researchers explain that both stem from how PHP handles fatal error unwinding: when PHP runs out of memory, its error handling path leaves memory in states it should not reach. CVE-2026-109618 focuses on out-of-memory handling where request data remains only partially initialized; CVE-2026-109619 concerns global memory structures left pointing at freed regions that the next request can read or branch on.
Neither requires authentication. A curl request with the right payload against certain PHP configurations gives remote code execution as the web worker account, per Trend Micro’s advisory. But both need specific knowledge of the target’s PHP memory limits and internals, which is why Palo Alto rates the pair 9.2 under CVSS 4.0 but also why exploitation is a targeted exercise rather than a spray. Production sites that tune their limits carefully and kill crashed workers raise the cost of an attack significantly.
How the scale problem adds up
Unit 42’s measurements are the clearest public measure of exposure: its Cortex Xpanse telemetry identified over 22.6 million internet-facing instances potentially vulnerable. The Bureau of Labor Statistics has historically tallied PHP among the most used server-side languages, and Fortune’s coverage puts “70% of the internet” on PHP-era stacks, a fair shorthand for CMS sites: WordPress alone hosts roughly 40% of all websites.
Most such sites are small businesses running shared hosting. The FBI and NSA warning matters most for exactly that audience: operators who never read vendor advisories, but whose payment processors, contact forms and appointment calendars all run on affected software. If attackers take over a restaurant reservation portal, the loss is not just the portal. It is a web shell that becomes an identity theft vector.
Who found the bugs, and how AI is involved
The disclosure story is as notable as the bugs. Fortune reports that the pair was discovered not by researchers reading code, but by automated discovery tooling from security company Wiz combined with OpenAI systems. OpenAI’s own post describes “coordinated disclosure of critical vulnerabilities” and the uncomfortable double edge: AI can uncover flaws with internet-scale impact, and the same capabilities also help attackers rapidly develop working exploits.
Both halves happened here. Sansec published PHP2Shell analysis on October 21, and Unit 42 published exploitation evidence on October 23: a European government entity was exploited within two hours of the initial advisory being pushed. In that incident, password hashes and multi-factor authentication secrets were pulled, an NTLM-relay tunnel into Active Directory was established, and privilege escalation toward Domain Admin was attempted. The attack chain used machine-readable output markers like ==SHELLUSER== with short, serially spaced tasks and quick pivots, which are strong indicators of agents rather than human keyboard input.
Was anything exploited yet
Yes. Palo Alto’s public reporting documents post-exploitation activity, and at least one European government agency took its own website offline as a precaution. Fortune’s headline framing, the race to patch before AI-powered hackers attack, matched the observed reality within roughly two days of the PHP Group’s patch release. Attackers have not used the same mass-scan approach as they do on WordPress plugins, since the vulnerability chain demands the exact target knowledge described above, but that is a reason not to ignore the fix anyway.
What PHP operators should actually do this week
Start with your version and exposure, not panic. Check whether you run PHP at all: shared-hosting dashboards, Plesk panels and plugin lists show the interpreter version. Then patch to the fixed release from the PHP Group’s security advisory, restart the web service, and confirm the fix took effect. If patching is not immediately possible, Unit 42’s guidance is direct: take the system offline or treat it as exposed until it is updated.
Next, verify config-level mitigations, because the bugs depend on specific memory limits and interpreter states. Review everything that runs PHP as CGI or FastCGI, since fast-cgi worker reuse is implicated in the technique described by Google Cloud’s security blog, which walks through the same out-of-memory and longjmp handling risks and published its own response post covering both CVEs.
Finally, hunt for signs of compromise rather than assuming a patched box is clean. Unit 42’s hunting queries in this threat brief cover process launches by web worker parents, which is where a PHP2Shell web shell would run. Search for unexpected process starts from php-cgi, php-fpm, or IIS workers, plus command batches wrapped in the machine-readable delimiters the recent attackers used.
What happens next
Three developments should be on your watch list. First, CEN and CISA additions: CISA routinely adds publicly exploited bugs to its Known Exploited Vulnerabilities catalog, and federal civilian agencies patch on mandated Biden schedules, which will push government patch rates up in the next two weeks. Second, expect scanning at scale: even if today’s attacks are surgical, attacker-authored scanners usually arrive within weeks of public proof-of-concept code, so unpatched servers should not expect the lull to hold. Third, expect more AI-discovered vulnerability disclosures like this one. Wiz’s automated find-and-fuzz loop over the PHP interpreter is now a repeatable workflow, and every maintainer of large language bodies needs tooling to match it.
For US small-business owners, the simplest rule stands: if your website’s host has not messaged you about PHP patching this week, message them. The fix shipped October 21; carriers charge nothing, and doing it before an automated attack finds you is the whole ballgame.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the industry name for two critical unauthenticated remote code execution bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, disclosed and fixed on October 21, 2026. Attackers may get code execution as the web server’s worker account without logging in.
Has PHP2Shell been exploited in the wild?
Yes. Evidence of public exploitation has been published by security researchers, and Palo Alto Unit 42 reported a European government exploited within about two hours of the advisory, using an agentic AI attacker chain.
How do I know if my server runs PHP?
Check your hosting dashboard or ask your host, which shows PHP interpreter version for each site. If you run WordPress or any PHP-based CMS, your site uses PHP, so apply the PHP Group’s October 21 update.
Sources:
- https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
- https://sansec.io/research/php2shell
- https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
- https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
- https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/
