Global Cybersecurity Crisis: Critical PHP2Shell Flaw Endangers Majority of Websites
A global cybersecurity crisis is currently unfolding online. The PHP development team released emergency patches on October 21, 2026, to address two critical vulnerabilities. These vulnerabilities, collectively known as PHP2Shell, could potentially enable unauthenticated attackers to remotely execute malicious code on web servers worldwide.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both flaws have been rated 9.2 out of 10 on the CVSS v4.0 severity scale. They affect virtually all PHP versions from PHP 5.4 through PHP 8. PHP powers an estimated 70% of all websites globally, including platforms like WordPress, Magento, and Drupal. This makes the potential attack surface enormous. The vulnerabilities were discovered by researchers at security firms Wiz, Calif, and OpenAI.
The patches are now available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory demanding immediate updates. The UK’s National Cyber Security Centre (NCSC) is urging organizations unable to patch immediately to take vulnerable systems offline. Amazon’s Threat Intelligence team has also confirmed that active exploit attempts were detected on its MadPot honeypot service as early as October 17.
Researchers at Wiz have warned that frontier AI models have played a key role in making these long-standing flaws exploitable. This has dramatically lowered the barrier for attackers. System administrators are strongly advised to update immediately.
Source: BleepingComputer – October 21, 2026