Governments, cloud providers, and website operators moved quickly to address two critical PHP vulnerabilities known together as PHP2Shell. The PHP Foundation released emergency fixes on Wednesday, October 21, and urged all PHP users to update immediately.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can allow an attacker to run code on a server without logging in. Each has a CVSS score of 9.2.

PHP supports a large share of the web. Wiz estimates that PHP runs about 70% of websites, while W3Techs places the figure at 75%.

PHP Versions With PHP2Shell Fixes

Emergency patches are available in the following PHP releases:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

The affected issues reach back to nearly every PHP release since version 5.4. PHP 8.1 and earlier versions do not receive an official fix.

The planned disclosure date was October 22. But information leaked online on October 20, prompting the release of patches one day earlier.

Why Organizations Took PHP Systems Offline

The U.S. National Security Agency advised organizations that could not patch immediately to take affected systems offline. The UK’s National Cyber Security Centre issued similar guidance.

According to BBC reporting, Japanese Prime Minister Sanae Takaichi urged website owners to take action that night. Wikimedia, the Finnish government, Dutch cyber authorities, and several Canadian provincial governments also took systems offline.

Cloudflare CEO Matthew Prince said attempted exploitation on the company’s network rose from thousands before the announcement to “millions now.” Amazon said it was targeted days before the disclosure, though its sites continued to operate normally.

Third PHP Vulnerability Announced

On Friday, October 23, PHP warned of a third vulnerability: CVE-2026-115560.

PHP described this issue as lower risk than the two PHP2Shell vulnerabilities. It will be addressed through a regular release rather than the emergency patch process.

AI Tools Used in the Vulnerability Discovery

OpenAI said security firm Calif found one of the PHP2Shell flaws with GPT-5.6 Sol through its Patch the Planet program. Wiz independently found and reported both vulnerabilities.

According to TechCrunch, Wiz used several AI tools during its work, including its Atlas agent, Gemini 4 Argon, and GPT-5.6 Sol.

OpenAI President Greg Brockman said the underlying bug had existed in PHP for 14 years. A limited version found in 2024 was not treated as serious. OpenAI called the issue one of the most impactful vulnerabilities in recent memory.

The company also released a PHP version checker and said it would provide $1 billion in subsidized access to its Daybreak program for defenders.

Conflicting Reports About Exploitation

The PHP Foundation described the delay in resolving the earlier issue as a “structural failure” tied to limited resources. It told CBC that it had not seen evidence of successful exploitation.

India’s CERT offered a different assessment, stating that multiple reports point to large-scale exploitation in the wild.

UNSW Sydney researcher Salil Kanhere told the BBC that the bugs themselves were not new. What changed, he said, was the ability to find them.