Key facts
- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were discovered.
- The bugs allow unauthenticated remote code execution, enabling attackers to access and modify data without passwords.
- PHP is used by approximately 70% of the web-facing internet, including platforms like WordPress, Drupal, and Joomla.
- AI was used in assistance with exploiting the bugs, according to researchers.
- Exploitation was detected by Amazon as early as October 17, 2026, before patches were widely available.
Two critical vulnerabilities in the widely used PHP web programming language, dubbed PHP2Shell, were discovered by security researchers at Calif. These bugs, officially designated as CVE-2026-109618 and CVE-2026-109619, allow attackers to gain unauthorized access to systems without needing a password. The PHP Foundation, which maintains the software, released patches on Wednesday, October 21, 2026, after coordinating with major internet companies and web hosts. Despite these efforts, exploitation was detected by Amazon as early as October 17, 2026, and confirmed compromises have been reported by security firms.