PHP2Shell Flaws Prompt Emergency Patches as AI-Driven Exploits Threaten 70% of Web Servers

Key points

• PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 include fixes for CVE-2026-109618 and CVE-2026-109619, which enable unauthenticated remote code execution.
• The vulnerabilities, present for decades, were made exploitable by frontier AI models, according to Wiz researchers. mod_php configurations face the greatest risk.
• Cloudflare deployed WAF rules for the known exploit vectors, available to all customers, including free tier users, while the UK's NCSC advises taking unpatched systems offline.
• The flaws affect approximately 70% of websites, according to the Wall Street Journal, and minimal source backports are available for PHP 7.4, 8.0, and 8.1 for users without LTS vendor support.
• Security researcher Kevin Beaumont warned of a 'mass of incidents,' while forensics expert Hal Pomeranz noted a 'long tail' of unpatched embedded installations.

Background

This follows a pattern of critical PHP-related vulnerabilities, such as the WordPress 7.1.2 patch for CVE-2026-87902 in September 2026, which also allowed unauthenticated remote code execution. The PHP2Shell flaws, rated 9.2 on the CVSS v4.0 scale, were leaked before their scheduled disclosure, prompting an emergency patch release at 14:00 UTC on October 21, 2026. While no active exploitation was confirmed at the time of the leak, security authorities urged immediate preparation for patching, particularly for internet-facing systems.

How outlets are covering it

Help Net Security and CNET emphasize the severity and widespread impact of the PHP2Shell vulnerabilities, with CNET citing the Wall Street Journal's estimate that 70% of websites could be affected. Cloudflare highlights its proactive deployment of WAF rules to mitigate the known exploit vectors, while the UK's NCSC takes a more conservative stance, advising organizations to take unpatched systems offline. Security researchers like Kevin Beaumont and Hal Pomeranz warn of a 'mass of incidents' and a 'long tail' of unpatched embedded installations, respectively, underscoring the challenges of widespread remediation.

Why it matters

The PHP2Shell vulnerabilities pose a significant threat to the stability and security of the internet, as PHP powers a large portion of web servers. The ability of AI to exploit long-standing flaws highlights the evolving nature of cybersecurity threats and the need for rapid response and patching. The widespread impact and the lack of reliable workarounds prior to the fix underscore the importance of immediate action by website administrators and the potential for mass exploitation if patches are not deployed promptly.

What to watch

Website administrators should immediately update their PHP installations to the patched versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35) or apply minimal source backports for older versions. Organizations should monitor for signs of exploitation and consider taking unpatched systems offline, as advised by the UK's NCSC. Cloudflare users should ensure their WAF rules are enabled to mitigate the known exploit vectors. Security experts expect a surge in attacks following the patch release, and administrators should prepare for potential incidents and long-term remediation efforts for unpatched embedded installations.