What happened

On 21 October, the PHP security team published an advisory about two critical vulnerabilities that can allow unauthenticated remote code execution, and urged all users to update immediately1. All PHP installations that serve web requests are at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php the highest-risk setup. An exploit has been demonstrated there in which an unauthenticated request triggers the attack before any application code runs1.

Both bugs are in the interpreter itself. That means sites built on WordPress, Drupal, Laravel or any other PHP engine are exposed. Wiz estimates that about 70% of the world's websites run on PHP2.

Mechanism: two memory-management bugs

  • CVE-2026-109618, "RCE via OOM corruption". Out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup then treats the corrupted data as valid1.
  • CVE-2026-109619, "RCE via stale global state". Internal request state outlives the memory it points to after that memory is freed. The next request handled by the same worker can use this state before normal initialisation1.

BleepingComputer notes that the two bugs share a root cause: PHP can leave memory corrupted when a request ends abnormally4. According to The Hacker News, the vulnerable code has existed for more than ten years and affects versions as far back as PHP 5.45.

The role of AI

Researchers at Calif and Wiz found the vulnerabilities using AI tools that analyse code faster than humans and older systems. Calif researcher Ryan Austin called it the most serious vulnerability of his career. OpenAI, whose technology was used, described it as one of the most significant security issues in recent times2. Wiz assessed the exploitation chain as being at the edge of what human researchers can practically achieve6. There is a downside: OpenAI acknowledges that AI also helps attackers build exploits faster2.

Leak, attacks and the official response

Details leaked online before the planned date, and PHP had to bring the publication forward2. Cloudflare enabled protective WAF rules for all plans, including the free tier, about nine hours before disclosure. It reports seeing attackers modify their payloads to get around the rules3. Cloudflare CEO Matthew Prince reported thousands of exploitation attempts before the announcement and millions afterwards. Amazon said it saw attack attempts several days before public disclosure2. watchTowr is tracking exploitation attempts, but no confirmed successful compromises had been reported at the time of publication6.

The US NSA called for systems that cannot be updated immediately to be taken offline. The UK's NCSC called for servers to be checked for backdoors. Wikimedia, the Finnish government and the Dutch cybersecurity agency took some systems offline as a precaution2.

What to do right now

  1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The project no longer supports PHP 8.1 and older. Minimal source-level backports have been released for 7.4, 8.0 and 8.1, and distributions received patches in advance1.

  2. If your site is managed by a hosting provider or contractor, ask whether the PHP fixes have been installed. Updating WordPress and plugins does not solve the problem23.

  3. If you cannot update immediately, the advisory lists temporary measures that reduce risk but do not make an installation safe[^1]:

    • set memory_limit=-1 with no ability to override it;
    • set a low post_max_size;
    • set session.upload_progress.enabled=0 and restart workers.

    The NCSC and NSA advise taking the site offline for the time being2.

  4. Check for signs of compromise, and do not disable your WAF while you update23.

  5. Watch out for phishing that will exploit the high-profile news. Verify emails such as "update your site urgently", "your hosting has been hacked" and password-change requests through the service's official channels2.

Limitations

The situation is still evolving. Exploitation data comes from individual companies' telemetry. No confirmed compromises had been reported at the time of publication. The exact number of vulnerable servers is unknown: the 70% figure describes how widely PHP is used, not measured vulnerability6.

  1. [1] Security advisory: Critical remote code execution vulnerabilities, update nowPHP Group
  2. [2] What is PHP and why did it spark a global cyber-security scramble?BBC News
  3. [3] Cloudflare deploys protections against php2shell vulnerabilityCloudflare
  4. [4] PHP ships emergency patches for critical PHP2Shell flawsBleepingComputer
  5. [5] PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts EmergeThe Hacker News
  6. [6] PHP2Shell Patches Land as First Exploitation Attempts Hit SensorsSecurityWeek