PHP2Shell Vulnerabilities Nearly Disrupted 70% of the Web, Prompting Swift Global Patching

Image: %items The Smartschool educational platform is offline, due to two critical vulnerabilities with the PHP programming language, on Wednesday 21 October 2026 in Edegem. BELGA PHOTO DIRK WAEM (Photo by DIRK WAEM / BELGA MAG / Belga / AFP via Getty Image · Source

Two critical PHP bugs dubbed PHP2Shell threatened widespread internet exploitation by enabling remote system access without passwords, leading to urgent industry-wide patching efforts and ongoing security concerns.

In late October 2026, two critical vulnerabilities in PHP, the open-source web programming language that underpins about 70% of internet-facing websites, nearly caused a massive internet disruption. These bugs, officially CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, allow unauthenticated remote code execution — effectively letting attackers take full control of vulnerable servers without any password access.

The bugs had been dormant since their discovery in 2024, initially deemed non-exploitable until researchers at the security firm Calif uncovered a method to leverage them recently. Upon confirming the threat, Calif notified the PHP Foundation, which coordinated a secretive embargoed release of patches to give major web companies and hosting providers a chance to secure their systems before the vulnerabilities became public.

As the patches went public on October 24, 2026, a swath of industries including banking, retail, healthcare, and government took websites offline temporarily to implement fixes. Despite careful coordination and early warnings, some exploitation attempts were detected by Amazon roughly a week prior to patch availability, suggesting attackers may have learned about the flaws ahead of time.

While no large-scale catastrophic exploitation has yet been recorded, security firms like Palo Alto Networks and Trail of Bits have observed confirmed post-exploit activity in some systems. Cloudflare noted an exponential increase in exploit attempts immediately after the disclosure, underscoring the urgency for remaining unpatched sites to apply updates quickly.

The widespread risk stems from PHP’s extensive use on popular platforms like WordPress, Drupal, Joomla, and MediaWiki (which powers Wikipedia). Many of these legacy technologies are maintained by unpaid open source contributors, limiting resources for security audits and increasing the likelihood that such critical vulnerabilities go unnoticed for years.

Although AI tools aided researchers in developing proof-of-concept exploits during the audit, Calif emphasized that deep domain expertise in PHP was crucial for uncovering these bugs. The incident also highlights the growing risk that AI will accelerate discovery of previously unknown vulnerabilities.

Experts warn this may be the first in a series of similar high-impact software scares, especially affecting aging codebases rife with "memory unsafe" flaws. Movements toward memory-safe programming languages like Python, Rust, and Swift seek to reduce such risks, but legacy code dominates much of the current internet infrastructure.

The PHP2Shell episode is a stark reminder of the fragile foundations underlying much of the web and the imperative for continuous vigilant security practices and timely patching to prevent future internet-wide crises.