'php2shell': AI-found PHP flaws push governments to pull websites offline
23 October 2026
Two critical PHP bugs allow unauthenticated remote code execution on servers handling web requests. OpenAI says its models helped uncover them. Finland, the Netherlands, France and Australia briefly took government services offline to patch, and US agencies urged admins to update immediately.
Incident status
- Active
- Contained
- Patch out
- Resolved
What to do
- Inventory every public-facing server running PHP, including WordPress and other CMS hosts
- Upgrade the PHP runtime itself to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (app or CMS updates don't fix it), then restart PHP-FPM, Apache and long-running workers
- On distro packages, confirm the changelog lists CVE-2026-109618 and CVE-2026-109619 rather than trusting the version number
- If an unpatched server shows signs of exploitation, treat it as compromised, not just exposed
Timeline
- 23 October 2026Tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v4 9.2). watchTowr and Cloudflare report active exploitation attempts; no confirmed break-ins yet. PHP 8.1 and older get no official fix.
- 21 October 2026PHP security release published; several governments take services offline to patch.
Based on reporting by The Hacker News. Read their full coverage for details.