Is The “php2shell” Flaw A Threat To You?

PHP — “PHP: Hypertext Preprocessor” — is an open-source, back-end programming language created in the early 1990s to generate dynamic web pages. When you load a page, PHP is the code gathering data and assembling it into something readable. It still underpins Wikipedia, WordPress, countless online stores, and developer frameworks such as Laravel, Symfony and Drupal. Cyber firm Wiz estimates it powers roughly 70% of the world’s websites — infrastructure so ubiquitous it is largely invisible, and largely assumed to be settled.

Two bugs, one decade, a 9.2 severity

This week, researchers at Wiz and Calif disclosed two vulnerabilities that they say sit inside the language itself, affecting versions released over the last ten years. Catalogued as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10, they were nicknamed php2shell because, under the right conditions, they could hand an attacker control of a web server and access to the data behind it. Calif’s Ryan Austin called it the most serious vulnerability he has ever found.

What changed was the search, not the bug

The bugs were not new. What changed was the ability to find them: the researchers used advanced AI code-analysis tools developed by OpenAI, capable of auditing code at a scale and speed human review never matched. The same capability cuts both ways — OpenAI noted AI can expose flaws but also help attackers build exploits faster. Details leaked online this week, forcing the disclosure timeline and compressing the window defenders rely on.

The scramble

The 21 October alert rippled outward. Wikimedia took systems down as a precaution; the Finnish government, Edinburgh council, some BBC pages and the Netherlands’ cyber-security agency pulled sites; the UK said 32 lower-profile sites were briefly offline; Orange suspended certain services globally; and Japan’s SoftBank temporarily suspended earthquake and tsunami alerts, urging customers to find another channel before a Monday resumption. The PHP Foundation released patches and told all users to update immediately. The US NSA said the flaw offers a “direct path” to a system’s database and told agencies to patch immediately or go offline; the EU, Singapore and Australia issued parallel warnings, and Japan’s Prime Minister Sanae Takaichi urged website owners publicly to check whether they ran on PHP.

The demand spike was immediate. Cloudflare chief Matthew Prince reported thousands of exploit attempts in the ten hours before disclosure, tens of thousands within 45 minutes of it, hundreds of thousands within two hours, and millions thereafter. Amazon said it was targeted repeatedly before public disclosure and stayed online. As of Friday, no successful attack had been reported — but researchers warn attempts will intensify as technical detail spreads, and that full impact may surface slowly.

Why small sites carry the most risk

Poorly maintained sites with thin security staffing are most exposed, and PHP is not confined to web apps: it hides in the management interfaces of network appliances, load balancers and embedded devices that rarely get treated as internet-facing. Patch adoption is climbing, but scan data suggests not fast enough globally.

The practical takeaway

If a host or developer manages your site, ask one question: has the PHP security fix been applied? Updating WordPress or its plugins does not resolve a flaw in PHP itself. If you self-manage, patching is on you — the UK NCSC advises taking a site offline temporarily if you cannot apply fixes quickly. Everyone else should expect password-reset requests, and expect phishers to ride the story.