PHP's Critical Vulnerability: The Week the Web's Workhorse Became Its Weak Point
Governments across the world including Australia pulled websites offline this week after two critical flaws were disclosed in PHP, the open-source language behind most of the web. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell", let an attacker take control of a web server without logging in.
PHP's volunteer maintainers shipped fixes on Wednesday 21 October 2026. By then the details had already leaked, proof-of-concept exploit code was circulating, and security firms were logging attack attempts.
The reach is what alarmed defenders. PHP runs an estimated 70 to 75 per cent of websites whose server-side language can be identified, including every WordPress, Drupal, Joomla and Magento site. Both flaws carry a severity score of 9.2 out of 10.
A flaw in the engine, not the apps
(Feel welcome to skip this bit as it gets a bit jargony)
The vulnerabilities sit in PHP's core runtime, not in the applications built on it. That is why, as Wiz Research put it, "even a simple 'Hello World' application running on an affected PHP version can be vulnerable."
Both stem from how PHP cleans up after a request fails, particularly when it runs out of memory. According to the PHP advisory:
• CVE-2026-109618 (remote code execution via out-of-memory corruption): a crash can leave internal request data half-built, and cleanup code then treats the broken data as valid.
• CVE-2026-109619 (remote code execution via stale state): data tied to one request can outlive the memory behind it, and the next request on the same worker may pick it up.
Wiz demonstrated unauthenticated takeovers of current WordPress, Drupal and Joomla installs. It also showed a "Heartbleed-style" leak that can spill server memory into a PHPSESSID cookie, even on sites that never use sessions.
Every PHP web setup is exposed, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project rates mod_php the highest risk, because an attack fires before any application code runs.
Which PHP versions are affected:
• Vulnerable: PHP 5.4 through 8.5.11
• Patched: 8.5.12, 8.4.27, 8.3.36, 8.2.35
• No official fix: 8.1 and earlier (end of life); minimal source backports published for 7.4, 8.0 and 8.1
Sources: PHP, Google Cloud.
Found by AI, leaked before the patch
The bugs appear to have sat in PHP for about a decade, and were found with AI. OpenAI said Ryan Austin of the security group Calif found one critical flaw using its GPT-5.6 Sol model, under its "Patch the Planet" programme. Wiz independently found and reported both, using its own Atlas tooling alongside Google's Gemini 4 Argon and GPT-5.6 Sol.
OpenAI called it "one of the most impactful security issues in recent memory" and argued that "frontier AI found these vulnerabilities before attackers did." It also warned that the same capability could help attackers, and said it expects more serious discoveries in the coming months.
The plan was a quiet, coordinated fix. PHP's maintainers led the patch; OpenAI, Wiz, Cloudflare, Linux distributions and hosting providers prepared protections in advance. That plan broke down in the final day. A Hacker News post quoted the CVE numbers before the embargo lifted, and within hours a researcher published alleged full details with two proofs of concept, iTnews reported.
Disclosure timeline (2026):
• 19 Aug: First flaw found
• 20–21 Aug: Unauthenticated takeover confirmed on Drupal, then WordPress
• 24 Aug: Wiz reports the flaws to the PHP security team
• 21 Sep: PHP acknowledges reports and begins work on a fix
• 21 Oct, before the patch: Embargo broken online; ASD and CERT-EU issue pre-patch warnings
• 21 Oct: Patched PHP releases and public disclosure; CVEs assigned
Timeline: Wiz Research, iTnews.
Governments: patch, or switch it off
Security agencies did something unusual: they warned before a patch existed, and told operators that going offline was a legitimate option.
CERT-EU, the cyber response team for EU institutions, issued advisory 2026-018 telling organisations to prepare for immediate patching and, where that was not possible, to "consider isolating internet-facing applications from public networks until a fix is available", Reuters and The Register reported.
In Australia, the Australian Signals Directorate issued a pre-patch alert saying the flaws "may affect all versions from PHP 5 onwards" and urging organisations to "monitor PHP applications and prepare to update and apply patches." ASD's own site, cyber.gov.au, was among Australian government websites that went down. A spokesperson for Home Affairs Minister Tony Burke confirmed "disruptions to several Australian websites" while risks were mitigated, the ABC reported.
In the US, the NSA said cyber actors were "likely to weaponize" the flaws and that they required immediate patching across federal departments. It advised replacing end-of-life PHP services and taking systems offline where an immediate update was not feasible. CISA issued its own alert.
Many took that advice on 21 October. According to a Reuters factbox and Engadget:
• Australia: Several government sites, including cyber.gov.au
• Belgium: Foreign ministry websites
• Canada: Federal government sites, announced by AI minister Evan Solomon
• Czech Republic: Government website, on the cyber watchdog's advice
• Denmark: Several Kombit services, including a national school platform
• Finland: Government public web services run by Valtori
• France: Prefecture (local government) websites
• Germany: Several websites of federal IT provider ITZBund
• Netherlands: Overheid.nl, Port of Rotterdam, parliament, the five largest parties, hospitals, the national cyber agency
The Wikimedia Foundation also took several systems down until they could be patched. Most operators described the shutdowns as precautionary, with no breaches reported.
Industry: stopgaps, and early attacks
Cloud and network providers moved to shield customers who could not patch at once. Cloudflare, Fastly, Akamai, Imperva, AWS, Microsoft, Vercel, Google and WordPress owner Automattic all published guidance or automatic protections, according to Wiz. Cloudflare CTO Dane Knecht was blunt about their limits: "This is a STOPGAP only. Patch as soon as PHP releases the update."
Google Cloud said its own platform was not vulnerable but customer workloads could be. Supported App Engine standard runtimes, and Cloud Run services with automatic base-image updates, are patched automatically. Everything else, including GKE containers, App Engine flexible and self-built images, must be rebuilt and redeployed. Customers on PHP 8.1 or earlier must move to 8.2 or newer.
Reports on exploitation differ. Jake Knott, head of threat intelligence at watchTowr, said his firm was "already observing in-the-wild exploitation", though none of the attempts it saw had succeeded, and added "we don't expect that will last long." Security vendor Hadrian described the flaws as "exploited in the wild at scale". No confirmed breach had been publicly attributed to PHP2Shell at the time of writing.
The Drupal Association's interim chief executive, Tiffany Farriss, summed up the scale: "This issue impacts the majority of the Internet."
What if your site is on Wix or another website builder?
If a hosted platform such as Wix, Squarespace, Shopify or Webflow runs your site, there is nothing for you to patch. The flaws are in PHP on the server, and on these platforms the provider owns and maintains the servers, not the customer.
Few builders had said anything publicly. Webflow posted a Trust Center notice on 21 October saying its core services were unaffected and no customer action was required, Amariq reported. As of 22 October, the same review found no statement from Wix, Squarespace, Shopify or Framer. Customers who need written assurance, for example for a compliance file, should ask the platform directly.
Who is responsible depends on who runs the server:
• Hosted builder (Wix, Squarespace, Shopify, Webflow): The platform patches. Nothing to do; ask for confirmation if needed.
• WordPress.com: Automattic patches. Nothing to do; WordPress.com says "every site on the platform is covered".
• Managed WordPress hosting: The host patches. Usually nothing to do; GoDaddy, for example, says it has patched all PHP versions.
• Shared hosting: The host patches. Check your host's status page; GoDaddy's shared-hosting fix was still waiting on a vendor package on 21 October.
• VPS or your own server: You, your developer or your agency patch. Update PHP now.
• Site run by a web agency: The agency patches. Ask what it has done.
Pressing "update" inside WordPress does not help. The fix is to PHP itself, and security firm Wordfence warned that "WordPress automatic updates will not apply this fix," according to Nebula Design.
Builder customers should still check for PHP outside the builder. A separately hosted blog, booking system, shop, client portal or form tool linked to the main site may run on its own PHP server, and each one needs the same check.
What operators should do now
Updating PHP is the only complete fix; every agency and vendor involved says the same. Pulled together from the PHP, NSA, Wiz and Google guidance:
1. Find every PHP instance. Huntress researcher John Hammond warned that "the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast": web servers, containers, control panels, appliances and third-party products. OpenAI has released a free version checker (php2shell-checker).
2. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your Linux distribution's updated package. Distributions received fixes in advance.
3. Replace PHP 8.1 and older. The project no longer supports them. Vendor backports exist for some, but the NSA advises replacing end-of-life services that cannot be patched.
4. If you cannot patch today, isolate or take the site offline, as CERT-EU and the NSA recommend. Web application firewall rules buy time but are not a fix.
5. Apply interim hardening if you must stay online. PHP lists steps including disabling session.upload_progress, tightening request-size limits at the proxy, and, on PHP 8.5, setting fatal_error_backtraces=0. It says none of these makes an installation safe.
6. Watch for signs of attack. Wiz flags unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, oversized or malformed PHPSESSID cookies, and unexplained PHP worker restarts.
7. Track your vendors. The NSA expects more software makers to ship patches for products that bundle PHP.
What comes next
The immediate risk now depends on how quickly operators patch, not on whether a fix exists. Working exploits are public, and attackers can scan the internet for vulnerable servers rather than pick targets one by one. Servers on unsupported PHP versions, which get no official fix, will be the hardest to close.
The longer-term issue is the method of discovery. Two AI labs and a security firm say their models found decade-old bugs in core web infrastructure in weeks. OpenAI itself expects more such findings soon. That is good news for defenders only if fixes can be coordinated and shipped faster than the same tools let attackers rediscover them, and this week's leaked embargo showed how narrow that window can be.
Given the role and the pace of AI in uncovering cybersecurity flaws in fundamental aspects of IT such as programming languages, expect more of these massive and critical alerts in the coming months and years.
Comments