On October 21, 2026, the PHP project released emergency security updates fixing two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell — that allow an attacker to run code remotely on an affected server without logging in. Both are rated 9.2 out of 10 for severity, and versions going back to PHP 5.4, released in 2012, are affected. The fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier receive no official fix.

The release was brought forward by a day after basic details of the flaws leaked on social media on October 20. Governments took websites offline as a precaution while applying the fixes — including France's prefecture websites, Germany's digital ministry, the Dutch parliament, Finland's central government, and, in the UK, the Office for Budget Responsibility and NHS Scotland. The US National Security Agency issued a rare public warning advising that websites be taken offline if they could not be updated immediately. A PHP security engineer compared PHP2Shell to Heartbleed, the 2014 flaw that sent administrators worldwide scrambling.

The AI angle is what makes this a landmark: the flaws went undetected for more than a decade and were found with the help of frontier AI models. PHP Foundation researchers had identified a theoretical flaw in 2024 but could not work out how it might be exploited; after the foundation joined OpenAI's 'Patch the Planet' initiative in July 2026, researchers at the security firm Calif reported the first flaw on August 11 using OpenAI's GPT-5.6 Sol, and Wiz — a security firm owned by Alphabet — reported the second on August 24 using models including Google's Gemini 4 Argon. Researchers estimate roughly 1.3 million internet-connected hosts could be exposed, and PHP powers around 70% of websites whose server-side language is known. AI found the flaws fast — and, as security firms warn, it can weaponize them just as fast, which is why patching now is the only safe option.

Sources