On October 21 the PHP project pushed emergency patches - PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 - to close two critical remote code execution flaws (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) affecting every version from PHP 5.4 through 8.5.11. With PHP behind an estimated 70 percent of the world websites, the disclosure triggered warnings from the U.S. NSA, the FBI and authorities in Singapore, Britain, Australia, Canada and the EU.
What the flaws do
CVE-2026-109618 stems from out-of-memory handling: if a request hits PHP memory_limit at the wrong moment, partially initialized internal data is later treated as valid, corrupting memory; on Apache with mod_php an unauthenticated request can trigger the attack before application code runs. CVE-2026-109619 is a use-after-free: a fatal error leaves internal state pointing to freed memory, which a later request handled by the same worker can exploit. The foundation said every installation serving web requests is at risk - PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed - with mod_php the highest risk.
How AI found it first
Frontier AI models drove the discovery. Security firm Calif, under an OpenAI-funded audit begun July 30, reported the first unconditional remote code execution on August 11 using OpenAI GPT-5.6 Sol; OpenAI reported the same root cause the same day. Wiz confirmed both issues with Gemini 4 Argon and its Wiz Atlas system. OpenAI said it spent two months leading a coalition to prepare fixes, calling PHP2Shell one of the most impactful vulnerabilities in recent memory while warning the same AI capability that helped defenders could equally help attackers.
Governments and companies go dark
The fallout was immediate. France took local government sites including the Paris police portal offline; the Netherlands pulled DigiD and the lower house site down; Belgium foreign ministry suspended sites; Australia ASD said cyber.gov.au was affected. In Japan, Codomon, BASE, Cygames and Pixiv suspended services. Palo Alto Networks counted more than 22.6 million exposed instances. Amazon said MadPot captured attack attempts even before disclosure.
Vendor responses and the disclosure debate
Google Cloud said its platform is not vulnerable but urged customers to patch immediately. Cloudflare said request data alone does not always distinguish exploits from normal traffic. OpenAI pledged $1 billion in subsidized access under its Daybreak program. The coordinated process was not clean: on October 21 at 07:41 UTC, more than six hours before the planned release, Chainguard unilaterally broke the embargo and published fixed images, letting attackers study the patch early; CVE details had also begun circulating around October 20.
What experts tell enterprises
PHP Foundation Elizabeth Barron urged everyone to upgrade as soon as possible; Wiz compared the flaws to a Heartbleed-style disclosure. Forrester Madelein van der Hout said organizations must map where PHP runs and prioritize internet-facing systems, adding a patch does not remove access an attacker already established. GuidePoint Justin Timothy said detection depends on behavioral hunting since no indicators of compromise exist. The foundation was blunt: updating is the only safe choice. With 2026 disclosures on track to roughly double last year record, PHP2Shell is likely the first of many emergency cycles.
Sources: PHP Foundation, Google Cloud Security Blog, TechTarget, Japan Today / AFP, CNBC via Sina Finance.
Wider exposure and what comes next
The scale of the problem goes beyond the sites that went dark. Palo Alto Networks put the exposed-instance count at more than 22.6 million, and the agencies coordinating the response warned that internet-facing PHP endpoints without the October 21 patches are effectively open targets. The practical guidance converges on a short checklist: inventory every PHP runtime on the network, prioritize mod_php and internet-facing installations, patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and treat a clean vulnerability scan as insufficient because no indicators of compromise have been published and detection currently depends on behavior-based hunting. The episode also sharpens the debate around AI in security: the same frontier models that found these flaws in weeks are now expected to accelerate exploit development, and with 2026 vulnerability disclosures on track to roughly double last year's record, security teams should expect more of these emergency windows, not fewer. For B2B website operators and hosting providers, the lesson is operational - patch velocity is now a supply-chain requirement, not a maintenance nicety.
What buyers and operators should do now
For companies that run their own sites or buy PHP-based services from vendors, the near-term checklist is the same as the agencies': confirm the exact PHP version in production, apply the October 21 patch on every internet-facing host before doing anything else, and ask hosting providers and SaaS vendors for written confirmation that their runtimes are patched. Longer term, the PHP2Shell episode argues for treating the PHP engine as critical infrastructure - version-pinning with a documented upgrade path, staged rollouts, and monitoring that looks for behavior anomalies rather than known attack signatures. The AI dimension makes this structural, not episodic: as disclosure volumes double and attackers gain the same discovery tools defenders used, the window between a published CVE and mass exploitation will keep shrinking. Enterprises that build patch-response capacity now will spend less time in the next emergency cycle - and there will be a next one.
