PHP2Shell: Critical PHP Flaws Trigger Global Patch Rush and Site Shutdowns

On October 21, 2026, the PHP project released emergency updates—versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35—to fix two critical security flaws that security researchers and vendors have nicknamed "PHP2Shell," according to Help Net Security and the Canadian Centre for Cyber Security. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are both described as critical-severity issues; the sources reviewed for this article did not cite an official numeric CVSS score.

What the vulnerability does

Both flaws are memory-safety bugs in how PHP handles requests under abnormal conditions, Bleeping Computer and Help Net Security reported. CVE-2026-109618 occurs when an out-of-memory error interrupts PHP while internal request data is only partly set up, so cleanup routines later treat that incomplete data as valid. CVE-2026-109619 is a stale-state flaw: memory tied to one request can be freed and then reused by a later request on the same worker before it is properly reset, which can expose data or allow code execution.

Canada's Centre for Cyber Security classified both as Use-After-Free vulnerabilities (CWE-416) and said a successful attack lets an unauthenticated attacker run arbitrary code on the server, without needing a password or any action from a user. The agency said mod_php deployments face the highest risk, since a demonstrated exploit can trigger the bug before any application code has a chance to run — a description also used by the PHP security team, as reported by Bleeping Computer.

The bug affects every PHP installation that serves web requests, including PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed, according to Bleeping Computer and the Canadian advisory. The underlying code had existed in PHP for more than a decade, Fortune reported, though official fixes were issued for the actively supported 8.2–8.5 branches, with source-level backports made available for 7.4 through 8.1, which are past their end-of-life support dates.

How it was found, and why AI matters here

According to Fortune, the flawed code had existed in PHP for more than a decade, but three separate parties converged on it in August 2026: security firm Wiz, a company called Calif, and OpenAI, working with the PHP Foundation on a fix and coordinated disclosure. Fortune reported that Wiz used AI models including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon to help understand the weakness and turn it into a working exploit. Wiz told Fortune the case represented a shift driven by AI, saying that while the vulnerable code had existed for more than a decade, what changed was researchers' ability to use AI to understand the weaknesses and turn them into a working exploit.

Fortune also reported that OpenAI, in its own statement, said the episode showed how AI can help uncover security flaws with internet-scale impact, while acknowledging that the same AI capabilities can also help attackers develop offensive tools and exploits more quickly.

Exploitation attempts and Cloudflare's early response

Cloudflare said on its own blog that it activated Web Application Firewall rules at 03:02 UTC on October 21, which it described as roughly nine hours before the vulnerabilities were publicly disclosed. The company rolled out seven "Generic Rules – Anomalous Execution" for free-tier customers and a separate set of seven equivalent rules for paid plans, plus one additional rule that checks both the request and the response within the same transaction, according to Cloudflare's post as summarized by ppc.land. The same post said Cloudflare observed attackers altering their exploit payloads afterward in an apparent attempt to evade the new rules, though it did not publish exact attack-volume figures.

Separately, Amazon's Threat Intelligence team said it had detected exploitation attempts against the flaws starting October 17, 2026—four days before the public patch—according to Bleeping Computer, suggesting some threat actors had access to exploit details before general disclosure. By contrast, Canada's Centre for Cyber Security advisory stated that, at the time it was written, it had not identified active exploitation, while cautioning that the situation could change quickly. The two assessments reflect different observation points and timing rather than a factual contradiction.

Japan: government urges patch or shutdown

The vulnerability drew particularly intense attention in Japan. Japan's National Cybersecurity Office, a successor body to NISC reorganized in July 2025, issued an advisory urging operators to check whether their websites run PHP and to act quickly, according to a BigGo Finance report on the agency's statement. Prime Minister Sanae Takaichi posted on X calling it "an urgent request for everyone to respond to tonight," and said that temporarily suspending a website could be an effective way to reduce risk if immediate patching was not possible, BigGo Finance reported.

Following that guidance, several Japanese online services entered emergency maintenance on the night of October 21, including childcare management platform CoDMON, the card game Shadowverse: Worlds Beyond, online shop builder BASE, and hosting provider Sakura Internet, according to the BigGo Finance report. PHP's official patches were released around 10:40 p.m. Japan time, ahead of an initially announced 11 p.m. target, the same report said.

Separately, Internet Watch (Impress) reported that Japanese communications provider Baltec suspended about 23 services—covering cloud, reservation, point-of-sale and expense-management tools—after detecting unauthorized access with possible exposure of personal data. Baltec initially attributed the incident to a cyberattack targeting a PHP vulnerability, but the company issued a correction the same day saying the actual cause was a vulnerability in its own service, not the PHP flaw, after it said it had confused the two issues while reviewing its PHP-related security measures. Baltec targeted service restoration for October 26, Internet Watch reported.

Scale of exposure

PHP powers an estimated 70% of websites worldwide, including WordPress sites, Wikipedia, Microsoft.com and Archive.org, Fortune reported, citing that roughly 40% of all websites run on WordPress, which itself depends on PHP. Fortune also cited an initial scan identifying 22.6 million potentially vulnerable PHP instances exposed to the internet.

What is still unknown

As of the available reporting, no source confirms a successful large-scale breach directly caused by PHP2Shell exploitation, as opposed to precautionary shutdowns. Figures on total exploitation attempts vary by source and measurement window: Cloudflare's CEO was cited in Japanese coverage via Yahoo! News as describing attempt counts rising from thousands before disclosure to tens of thousands within 45 minutes and reaching the hundreds of thousands within two hours, with totals described as reaching into the millions by the time of that report; Cloudflare's own blog post did not repeat these specific figures. Readers should treat precise attack-volume numbers as preliminary and subject to revision by the organizations tracking them.