Two critical security vulnerabilities in PHP have triggered emergency software updates and temporary website shutdowns worldwide. A set of vulnerabilities called PHP2Shell were disclosed on October 21, 2026. These vulnerabilities could allow hackers to execute malicious code on affected servers without the need of login credentials.
Both vulnerabilities were assigned CVE-2026-109618 and CVE-2026-109619 and received a critical CVSS 4.0 severity score of 9.2. The U.S. National Security Agency (NSA) is encouraging organizations to patch vulnerable systems as soon as possible.
What Is PHP2Shell? Why Is It Dangerous?
PHP is a coding language that is widely used to run websites, like the ones built on WordPress, Drupal and Joomla. It creates dynamic web pages, processes requests and retrieves data from databases.
PHP2Shell exploits vulnerabilities in the core engine of PHP itself, not in a specific website plugin.
CVE-2026-109618 Out-of-memory error handling can lead to memory corruption. CVE-2026-109619 Unsafe use of released memory.
These vulnerabilities could potentially allow remote code execution under exploitable conditions that could lead to disclosure of sensitive information or attainment of control over compromised web servers by attackers.
Simply updating WordPress or other website applications will not solve the underlying risk, as the vulnerabilities are inherent in PHP.
PHP servers were hacked before the public disclosure.
On October 17, Amazon Threat Intelligence detected a PHP2Shell exploitation attempt, four days before the vulnerabilities were made public. Further malicious activity was observed in the area of the October 21 disclosure.”
The security emergency forced government agencies and businesses in many countries to temporarily pull their Web sites offline as they installed patches to fix the problem.
Palo Alto Networks’ Unit 42 also observed post-exploitation activity against a European government organization, which included attempts to gain further access within the organization’s network and to obtain credentials.
The findings confirm a significant security threat, but it is essential to keep in mind that detected attack attempts should not be equated with successful compromises.
Artificial intelligence was also part of the discovery process. Security researchers have used AI-assisted analysis to explore and demonstrate the possible effects of years-old PHP memory-management vulnerabilities.
Older PHP installations should be migrated to a supported version or vendor-supported security backports.
Administrators of the sites should check the PHP version currently served on their servers, install the necessary updates and restart the affected services, in addition to checking the logs for any signs of suspicious activity.
Web application firewalls can reduce exposure to known attack patterns, but they cannot substitute for security patches to PHP.
The significance of the PHP vulnerability in October 2026
PHP2Shell is an example of how vulnerabilities in a popular programming language can be a threat, even with otherwise well-maintained websites.
The incident also highlights a tough security reality: software vulnerabilities can lie dormant for years until new research techniques make them exploitable in practice.
Businesses, government agencies and hosting providers should immediately check for any unauthorized activity and secure vulnerable PHP installations.
The biggest threat left over is not only the discovery of PHP2Shell but the number of servers open to the Internet that might continue to run without the necessary security updates.