Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitycriticalExploited in the wild

PHP patches PHP2Shell flaws as exploit attempts and exposure continue

9 sources · 10 articlesFirst reported Updated ()
What's new

October 23–24: Lobsters and TechCrunch say a bug was noted in a 2024 audit and only later shown exploitable; TechCrunch says mass exploitation was broadly avoided.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP has patched two critical PHP2Shell engine bugs while exploit attempts climb and many sites remain exposed.

PHP patched two engine flaws, CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, that allow unauthenticated remote code execution and date to PHP 5 in 2004. Latent Space, OpenAI, and Help Net Security say Calif, using GPT-5.6 Sol, and Wiz independently found them; October 24 TechCrunch says Calif found them and OpenAI and Wiz verified proofs of concept. TechCrunch recommends PHP 8.5.12; PHP 8.1 and older are unsupported. Major sites went offline to patch. OpenAI first reported no exploitation, Cloudflare described attempts rising into the millions, and October 24 TechCrunch said mass exploitation was broadly avoided.

Key facts
  • watchTowr rated both bugs 9.2; Lobsters says leaked scores claimed 10.0.
  • VulnCheck says a private exploit reaches RCE on PHP 8.4.26 with ASLR.
  • Cloudflare deployed WAF rules, including on the free tier, as a stopgap.
  • WordPress said the flaws are not CMS-specific and hosts must patch PHP.
  • OpenAI offered a PHP version checker and proposed a five-stage response plan.
  • Lobsters says a Calif video and early Chainguard fix broke the embargo.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026PHP2Shell patches released after the date was moved up · Lobsters
  2. Oct 22, 2026Original planned patch date before the embargo moved · Lobsters

What each outlet adds

beyond the shared facts
  • Latent SpaceNames both CVEs and says Cloudflare saw early attacks.
  • The VergeSites went offline; attempts rose into the millions.
  • The RegisterVulnCheck private exploit works on PHP 8.4.26 with ASLR.
  • TechCrunchRecommends PHP 8.5.12 and later says mass exploitation was avoided.
  • LobstersEmbargo leak, patch moved from October 22 to October 21.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPCloudflareOpenAIPHP Foundation
Products
WordPressDrupalPHPJoomlaMediaWikiWiz Atlas
Victims
Internet ArchiveDeviantArt4chanWikipediaWorld QuestSave My Demonic WorldPokémon HomePokémon Champions
Organizations
CalifWizOpenAINSANCSCWhite HousewatchTowrPHP FoundationCloudflareVulnCheckGoogleCISA
Countries
United StatesUnited KingdomNetherlandsFinland
AI models
GPT-5.6 SolGemini 4 Argon

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Hacker News · securityFirst report

    OpenAI coordinates fixes for critical PHP flaws found with GPT-5.6

    Calif used GPT-5.6 Sol and Wiz independently reported both flaws; maintainers led the fixes and a version checker is available.

  2. · 4d ago TechCrunch · Security

    NSA warns of two critical PHP flaws present since version 5

    OpenAI and Wiz say the holes were found before attackers; unpatched sites should go offline, and PHP 8.5.12 is recommended.

  3. · 3d ago The Decoder

    GPT-5.6 Sol and Gemini 4 Argon found a critical PHP flaw

    OpenAI says the models found the issues before attackers, and a GitHub tool checks whether a PHP version is affected.

  4. · 3d ago Help Net Security

    OpenAI outlines a five-stage response plan for AI-found critical bugs

    The plan follows a two-month PHP response in which Calif and Wiz independently found the flaws.

  5. · 3d ago Latent Space

    Core PHP PHP2Shell bugs enable unauthenticated RCE, two teams report

    Calif, using GPT-5.6 Sol, and Wiz independently found CVE-2026-109618 and CVE-2026-109619 after about two months of private coordination.

  6. · 3d ago The Verge · AI

    Critical PHP flaws prompt site shutdowns as exploit attempts surge

    watchTowr says both bugs are remote code execution from PHP 5 onward and were rated 9.2 of 10.

  7. · 3d ago Ars Technica · AI

    PHP2Shell flaws can give unauthenticated control of website servers

    Calif and Wiz found the bugs; OpenAI helped PHP develop patches, and the NSA urged taking unpatched systems offline.

  8. · 2d ago The Register · Security

    VulnCheck exploit bypasses ASLR for PHP2Shell remote code execution

    The private exploit chains a memory leak into RCE on PHP 8.4.26 with ASLR on and display_errors off.

  9. · 2d ago Lobsters · security

    Essay says AI shrank PHP2Shell exploit time to hours

    The author says CVE-2026-109618 and CVE-2026-109619 were exploited before the delayed patch, after leaks broke the embargo.

  10. · 1d ago TechCrunch · Security

    PHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell

    Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109619
+1 related CVE
CVE-2026-109618
Use-after-free RCE in PHP via stale request globals
9.2100%PoC ×13