Emergency Patch Released for ‘PHP2Shell,’ a Critical Flaw in Software Behind Most Websites
AI models found the two flaws, which had sat unnoticed in PHP for decades. Governments are taking sites offline, and attacks are expected within minutes of the fix going public.
Emergency patches went out Wednesday morning for two critical vulnerabilities in PHP, the programming language behind more than 70% of the world's websites. Security researchers are calling the disclosure PHP2Shell.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP's own developers rated both a 9.2 out of 10: critical.
The PHP team released fixed versions at 9:34 a.m. ET — 26 minutes ahead of schedule, after word of the flaws leaked on Hacker News and was confirmed by the security firm watchTowr. PHP.net had posted an early warning Tuesday telling administrators to get ready.
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Versions 7.4, 8.0, and 8.1 got source-code patches but no official new binaries, because those versions are past their end of life.
The bugs had been sitting in PHP for decades, according to Wiz, the Google-owned security firm that found them independently. Wiz called them "among the most severe vulnerabilities discovered in PHP, and arguably in software history." Proving they were exploitable took a chain of steps "at the edge of what human researchers could practically achieve," the firm said.
The other finder was Calif, a California security firm working with OpenAI's "Patch the Planet" program. Both teams used AI models to hunt the flaws down. Calif reported the first flaw to PHP on Aug. 11; Wiz reported the second on Aug. 24.
OpenAI coordinated the disclosure with U.S. and foreign government agencies, including the Cybersecurity and Infrastructure Security Agency and the White House's Office of the National Cyber Director, as well as infrastructure providers. It called PHP2Shell "one of the most impactful security issues in recent memory."
The White House said in a statement at noon Wednesday that the government was notified of the vulnerability on Oct. 16 and is working with federal agencies and AI companies "to expedite the release of the fix to users of the PHP programming language and to protect American networks and critical infrastructure." The statement credited "Super Intelligence" — President Trump's term for AI — with finding the flaw.
Europe's CERT-EU told administrators to take affected sites offline rather than leave them exposed. The government of Finland and the Dutch House of Representatives disconnected their sites Wednesday, according to Cybersecurity Dive.
Cloudflare said it saw signs of early exploitation before the patches went out and put up temporary firewall rules as a stopgap. Proof-of-concept code was already circulating online before the release, and security firm Sansec expects mass attacks to start within minutes of it.
Website owners should update PHP on their servers. Updating WordPress or another app does not update the PHP underneath it — the server package or container image is what needs the patch.
