Earlier this week, researchers revealed two severe vulnerabilities in PHP—identified as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell—that threatened to compromise a huge swath of the internet. These flaws enable unauthenticated remote code execution, letting attackers gain full control over web-facing systems without needing any password.
Discovery and scope
The vulnerabilities weren’t new. They were first identified in 2024 but initially judged not exploitable and left unpatched. It wasn’t until researchers at Calif (an independent security firm) recently found methods to weaponize them that the PHP Foundation was alerted. The organization then issued patches under a coordinated disclosure process, giving large-scale hosters and major web platforms a chance to prepare before details went public.
PHP powers about 70% of web-facing sites—WordPress, Drupal, Joomla, MediaWiki among them—so the risk was massive. While PHP usage has slowly declined over recent years, its entrenched position across the web means that vulnerabilities in it can have far-reaching consequences.
Damage, response, and what’s next
When the bugs became public, many organizations rushed to patch systems, with some even taking sites offline temporarily. Banks, hospitals, retailers, gaming platforms, and government agencies were among those affected. Despite major mitigation efforts, many systems remain unpatched and open to attack.
Evidence suggests malicious actors were already attempting exploits before patch release—some activity detected as early as October 17. The fact that the patches were pushed live hours before the embargo lifted may have exposed important technical details prematurely. Open source code visibility means that once a patch goes live, anyone can inspect and derive how attacks might be constructed.
To date, there’s no sign of mass destruction, but confirmed cases of post-exploit activity have emerged, conducted by threat actors identified by firms like Palo Alto Networks and Trail of Bits. Cloudflare has observed exponential numbers of exploitation attempts following disclosure.
Legacy tech, memory safety, and AI’s role
PHP is decades old, and like many “memory-unsafe” technologies, it remains vulnerable to bugs that allow attackers to spill sensitive data or hijack system control. Memory-related vulnerabilities account for a majority of exploited flaws, according to the U.S. National Security Agency. In contrast, languages built with memory safety in mind—Rust, Swift, even Python to some degree—avoid whole classes of these risks.
This time, AI played a supporting role. Calif used tools and techniques from OpenAI and Wiz’s “Hack the Planet” initiative to verify proof-of-concepts and help automate parts of the analysis. But exploitability required deep understanding of PHP’s codebase and architecture; AI helped, but didn’t do the heavy lifting.
It’s a relief that disaster was largely avoided—but the internet’s foundations still look surprisingly fragile. PHP2Shell highlights how gaps in widely used legacy software can go undiscovered for years and erupt suddenly, leaving systems exposed. As AI tools become more powerful, they may speed up both discovery and exploitation of such bugs.
Moving forward, organizations must not only patch immediately, but also audit legacy components, enforce better memory safety practices, and tighten embargo protocols. What feels like one crisis might very well be a turning point in how we think about maintaining the older technologies we depend on.
