PHP2Shell Vulnerabilities: How Two Bugs Almost Broke the Web

What Are the PHP2Shell Vulnerabilities?

The PHP2Shell vulnerabilities are two critical security flaws in PHP, a decades-old open-source web technology, that almost broke the internet. Officially designated as CVE-2026-109618 and CVE-2026-109619, these PHP2Shell vulnerabilities sat dormant for years until researchers recently figured out how to exploit them.

In simple terms, the PHP2Shell vulnerabilities allow anyone who knows how to exploit them to break into an online system running PHP, such as a website or internet-facing server, without needing a password to access or modify its data. The situation forced millions of people around the world to scramble to patch their systems before malicious hackers could abuse them.

The PHP Foundation, which maintains the PHP web software, publicly released patches on Wednesday that fixed the bugs and prevent web-facing servers from being attacked. The foundation had already given some of the biggest internet companies and web hosts that rely on PHP an early headstart on patching.

How the PHP2Shell Vulnerabilities Were Discovered

Security researchers found two bugs in PHP, a programming language widely used around the world for building websites and web apps, both on the internet and hosted locally on company networks like intranets and internal sites. PHP is open-source, meaning it’s free and available to be used by anyone for almost any reason, which has made it one of the most popular and broadly used web programming languages today.

The two bugs were first discovered in 2024 but weren’t considered exploitable at the time and weren’t patched. Security researchers recently found a way to exploit them, prompting them to alert the makers of the software to get them fixed.

The PHP Foundation then began a period of fixing the bugs and coordinated disclosure. It offered information and patches about the security issues under a tightly guarded embargo — held confidentially until a specific deadline — to give big companies an opportunity to get ahead of installing the fixes.

Why the PHP2Shell Vulnerabilities Are So Serious

The PHP2Shell vulnerabilities are serious because they can be abused remotely over the internet without the victim having to click on a link or open a file. This is known as remote code execution, one of the more damaging kinds of bugs to exploit because it can grant a hacker anywhere in the world effectively full control over an affected and unpatched system.

Worse, these specific PHP bugs make it possible to break into any unpatched system on the internet without needing a password or any other credential, known as unauthenticated access. This would allow a malicious hacker to plant malware on the computer, such as to steal data or maintain a long-term foothold they can return to later.

Why 70% of the Web Was Affected

The bugs are particularly risky because PHP is wildly popular software, partly because it’s free and relatively easy to use, but also because it’s been around for decades. Around 70% of the web-facing internet relies on PHP, though its usage has been slowly declining in favor of newer, more secure programming languages.

Given its popularity, some of the world’s most popular websites run on web software that relies on PHP, such as WordPress, Drupal, Joomla, and MediaWiki. PHP is just one of many aging but functional technologies that have survived waves of the internet and are now so ubiquitous they’re akin to the glue that holds much of the internet together.

These tools are often developed by open source maintainers who are not paid for their work and cannot afford third-party security reviews, yet are still widely relied on by companies that do not contribute financially to the projects.

Was AI Used to Discover the Bugs?

Security researchers were credited with discovering the bugs earlier this year as part of a security audit of PHP’s code, participating in an industry initiative alongside AI model makers and cloud security firms that subsequently verified the proof-of-concept exploits.

In the researchers’ write-up, they explained that AI was used in assistance with exploiting the bug, but that the bulk of the work relied on knowledge the researchers already had, and that they knew PHP’s codebase and exploitation history well.

“No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now,” the researchers wrote.

Why the Bugs Were Exploited Ahead of Disclosure

Despite efforts to keep details under wraps until Wednesday, there was some PHP2Shell exploitation prior to the release of patches. Amazon, which has enormous visibility into online threats, said in a blog post that it detected exploitation about a week before the PHP patches were available, suggesting someone knew how to exploit the bugs before details were broadly available. Defenders should look for evidence of exploitation as early as October 17.

There are a few theories. Once a bug is patched, patch details can become immediately apparent, especially when the code is open source and publicly inspectable. Exploiting the bugs might not be easy, but knowing where the bug is and how it was fixed can help malicious hackers understand where to target and how to develop exploits.

It’s possible there was a leak or breakdown in communication during the embargo, since the open source community is enormous and controlling information relies on good faith. Hackers may also have discovered the bugs independently or through espionage. The PHP Foundation blamed one company for pushing patches live hours before the embargo ended, which could have given some attackers a headstart.

Did the Internet Dodge the Worst of It?

It’s still early days, but it’s encouraging that there haven’t been signs of mass exploitation — though we’re not out of the danger zone yet. Network security giant Cloudflare said this week it has seen an exponential number of attempts to exploit the bugs following disclosure, showing how quickly malicious actors are seeking to abuse the flaws.

PHP isn’t just found on web servers; it’s also used in developer tools, command line and terminal packages, and other software components used by routers, storage devices, and enterprise security devices like firewalls and VPNs. Expect to see exploitation of the PHP2Shell vulnerabilities down the line as smaller IT teams and sole developers may be slower to update.

As more devices and systems get updated, the attack surface will reduce over time. But the ripple effects could still be felt for years, particularly in legacy systems that have no means to be updated.

Will This Happen Again?

In 2016, a massive botnet flooded an internet registry with junk traffic, causing much of the web’s top services to crawl to a halt. In 2017, North Korea used leaked U.S. government hacking tools to infect the U.K.’s health system with ransomware. And in 2024, a faulty security update sparked a massive global outage causing most of the world’s Windows computers to crash at once.

By all accounts, the internet escaped what could have been an extremely painful and damaging day. But it’s unlikely to be the last major incident, and this may be the first in a trend of incidents that exploit weaknesses in legacy technology — due to inherent flaws in aging but omnipresent software coupled with AI tools making it easier to find flaws.

PHP, like other web technologies from decades ago, is “memory unsafe,” meaning it can be attacked through an entire class of vulnerabilities that can force the software to leak sensitive data from memory storage. The National Security Agency says around 75% of all actively exploited vulnerabilities abuse memory-related flaws.

This has prompted a move to memory-safe languages like Python, Rust, and Swift, which can’t be abused the same way. But that still leaves a chunk of the internet running technologies like PHP, media and video codecs, and compression libraries from decades ago — which, when they break, will have massive implications for the rest of the web.