PHP flaws called PHP2Shell set off global patching rush as first attacks are confirmed
Two old bugs in PHP could let attackers take over unpatched servers without a password, TechCrunch reported. Patches came out Wednesday, but many systems are still exposed.
Two serious security flaws in PHP, an open-source programming language widely used to build websites, led organizations around the world to rush out fixes this week, according to TechCrunch.
The PHP Foundation, which maintains PHP, released patches on Wednesday for the bugs. They are known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. TechCrunch reported that the flaws let an attacker take control of an unpatched system running PHP, such as a website or an internet-facing server, from anywhere over the internet and without a password. The victim does not have to click a link or open a file.
TechCrunch reported that banks, retailers, gaming sites, online stores, hospitals and some government agencies took their servers offline to patch them. Governments urged citizens and companies with websites to act. Some of the largest internet companies and web hosts had been given the patches early, under an embargo.
The bugs were first found in 2024 but were not considered exploitable at the time, so they were not fixed, according to the report. Researchers at the security firm Calif later found a way to exploit them during an audit of PHP's code and alerted the PHP Foundation. Calif said it used AI to help exploit the bugs, but that most of the work drew on what its researchers already knew about PHP.
“No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now,”Calif, in its write-up
The flaws matter because PHP is so widespread. TechCrunch reported that about 70% of the web-facing internet relies on it, including software such as WordPress, Drupal, Joomla and MediaWiki, which runs Wikipedia. PHP is also used in routers, storage devices, firewalls and VPNs.
Attacks have already started. TechCrunch, citing a blog post from Amazon, reported that Amazon saw the bugs being exploited about a week before the patches came out, and told defenders to look for signs of exploitation from as early as October 17. As of late Friday, Palo Alto Networks and Trail of Bits had confirmed break-ins and malicious activity after exploitation, according to the report. Cloudflare chief executive Matthew Prince said the company had seen attempts to exploit the bugs rise exponentially after they were disclosed.
Much is still unknown. Amazon said it was unclear how the attacker found out about the flaws before they were made public. The PHP Foundation blamed one company for releasing the patches hours before the embargo ended, but TechCrunch noted that this does not explain the activity Amazon saw a week earlier. The targets of the confirmed attacks have not been identified. Security researchers told TechCrunch that many systems around the world are still unpatched, and that smaller IT teams and older systems that cannot be updated may stay exposed for a long time.
