> ## Content Index
> Fetch the complete content index at: https://www.borealian.ca/llms.txt
> Use this file to discover other available public pages before exploring further.

# PHP2Shell: Critical flaws threaten millions of websites
- URL: https://www.borealian.ca/php2shell-critical-flaws-php/
- Published: 2026-10-25T16:24:08.000Z
- Updated: 2026-10-25T16:24:08.000Z
- Description: Two small errors in one open-source codebase threatened the security of over half a billion websites this past week.
- Author: Beaverbrook
- Tags: Business & Markets, Cybersecurity, Open source, Artificial intelligence, Software

On Oct. 21, the PHP project [released](https://www.php.net/index.php?ref=borealian.ca) versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix "two critical vulnerabilities that can allow unauthenticated remote code execution." PHP is the language behind 69.2 per cent of the world's websites, [W3Techs](https://w3techs.com/technologies/details/pl-php?ref=borealian.ca) reports.

The flaws, CVE-2026-109618 and CVE-2026-109619, are known as PHP2Shell. The PHP Group rates both 9.2 out of 10, "Critical," on version 4.0 of the CVSS scale, according to the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-109619&ref=borealian.ca). Both are memory-safety errors in PHP's core engine, including use-after-free, and they are triggered when PHP runs out of memory or hits a fatal error. The Canadian Centre for Cyber Security [says](https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619?ref=borealian.ca) a successful attack could let an unauthenticated attacker run code on the server. [Wiz](https://www.wiz.io/blog/php2shell-php-rce?ref=borealian.ca) adds that an attacker could read server memory holding passwords, tokens and keys.

The PHP project says every installation serving web requests is exposed, including PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP and LiteSpeed. It puts the risk "highest for mod\_php." Its release note is blunt: "There are no complete mitigations, updating is the only safe choice." On Oct. 23, PHP [disclosed](https://www.php.net/index.php?ref=borealian.ca) a related flaw, CVE-2026-115560, that survives the patches under an "unusual combination of configuration and application code." It will be fixed in the next regular release.

## Who found it

The [PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/?ref=borealian.ca) says a 2024 audit by Quarkslab, paid for by Germany's Sovereign Tech Agency, found "the first signs of the OOM problem," although no concrete attack was found then. [Calif](https://calif.io/php2shell/?ref=borealian.ca) dates its discovery to Aug. 1, 2026, using OpenAI's GPT-5.6 Sol model under OpenAI's Patch the Planet program. The Foundation dates Calif's report to Aug. 11.

Wiz says "Wiz Research uncovered" the flaws, dates its first discovery to Aug. 19 and says it reported on Aug. 24\. [OpenAI](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/?ref=borealian.ca) says Calif found "a critical flaw" and Wiz "independently" found both. The CVE record credits Wiz, Calif and OpenAI as reporters. Four core developers, Arnaud Le Blanc, Ilija Tovilo, Jakub Zelenka and Nora Dossche, are credited with the fixes.

## The reaction

In Canada, the first visible effect was missing websites. AI Minister Evan Solomon said on X that some federal sites were "temporarily taken offline as a precaution," following the Cyber Centre's guidance, [Global News reported](https://globalnews.ca/news/12113047/statistics-canada-website-down-php-hacks/?ref=borealian.ca). Statistics Canada was back around noon on Oct. 22\. The government has published no list of the sites affected. Treasury Board's chief information officer [said](https://www.canada.ca/en/treasury-board-secretariat/news/2026/10/statement-from-the-office-of-the-chief-information-officer-of-the-government-of-canada-on-critical-vulnerabilities-in-php.html?ref=borealian.ca) there was "no indication at this time" of any federal compromise.

Luckily, there has been little evidence of successful attacks. [CISA](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching?ref=borealian.ca) said on Oct. 21 that it had not seen successful exploitation, and neither flaw was in its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/sites/default/files/feeds/known%5Fexploited%5Fvulnerabilities.json?ref=borealian.ca) as of the Oct. 23 version. [Amazon](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/?ref=borealian.ca) says it recorded an exploit attempt on one of its honeypots on Oct. 17, four days before disclosure. Palo Alto Networks' [Unit 42](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?ref=borealian.ca) is the only source describing a successful break-in, which it says hit an unnamed European government body. [Sophos](https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619?ref=borealian.ca) reported a success on Oct. 22, then corrected itself the same day to "a small number of failed exploitation attempts."

## How it is being fixed

PHP 8.1 and earlier get no official release, although the security team posted minimal source patches for 7.4, 8.0 and 8.1\. PHP 8.2 loses security support on Dec. 31, 67 days after the release. CISA says systems that cannot be updated should be taken offline until they can be patched. Where patching is not feasible, the [Cyber Centre](https://www.cyber.gc.ca/en/news-events/statement-regarding-critical-vulnerabilities-php-affecting-websites-online-services?ref=borealian.ca) advises isolating internet-facing applications from public networks, and its alert advises reviewing logs for signs of compromise.

Most of that work falls on whoever runs the server. A day after the release, [Infrawatch](https://infrawatch.com/blog/php2shell-24-hours-global-php-patch-uptake?ref=borealian.ca) found a fixed version on 4.39 per cent of PHP services that display one, and [OX Security](https://www.ox.security/blog/php2shell-24-hours-in-99-3-of-measurable-php-instances-are-still-unpatched/?ref=borealian.ca) put the figure at 0.72 per cent.

## Old code, new tools

PHP dates to the early 1990s, and Wiz and Calif say the flawed code goes back to PHP 5.4\. Wiz compares the memory leak to Heartbleed, the [2014 OpenSSL flaw](https://nvd.nist.gov/vuln/detail/CVE-2014-0160?ref=borealian.ca) that exposed server memory, and to [Log4Shell](https://nvd.nist.gov/vuln/detail/CVE-2021-44228?ref=borealian.ca) in 2021\. Like those two, PHP2Shell is reported as an accident, unlike the deliberate [xz utils](https://www.openwall.com/lists/oss-security/2024/03/29/4?ref=borealian.ca) backdoor of 2024.

As seen above, exploiting flaws in the code is nothing new. What has changed is the speed of discovery. Wiz says that with frontier AI models "a single researcher completed in a week what previously would have taken a world-class team months of work." OpenAI warns that "the same capabilities can also help attackers rapidly develop offensive tools," and Unit 42 reports attackers using "agentic AI attack platforms." Calif's own researcher cautions that no model finds "all bugs" with simple prompts, and Sophos says a working exploit "is proving challenging even with AI support."

In response to this mounting challenge, OpenAI committed US$1 billion to its [Daybreak for the Frontline Defenders](https://openai.com/index/daybreak-for-frontline-defenders/?ref=borealian.ca) program to subsidized access to, training, and technical support that will "help resource-constrained organizations find software vulnerabilities, hunt for suspicious activity, and defend against AI-enabled cyberattacks."

The repair still rests on a few people. The PHP Foundation says security work "still depends on a small group of foundation-funded developers and a little volunteer help," and its post ends with an appeal for sponsors. It is a reminder of how much of the Internet runs on code developed by early enthusiasts and researchers in the '90s. It calls into question the sustainability of the open-source and foundation model for an Internet that is a lot bigger and scarier than the founders ever anticipated.