PHP2Shell: Two Dormant Bugs Just Put 70% of the Web at Risk

Roughly 70% of the web-facing internet runs on PHP, and on Wednesday two unpatched bugs in that language came close to breaking a large part of it. The flaws, dubbed PHP2Shell and designated CVE-2026-109618 and CVE-2026-109619, let anyone who knows how to exploit them break into an internet-facing PHP system — a website, a server — without a password, and access or modify its data.

The PHP Foundation, which maintains the software, released patches on Wednesday. It had already given some of the biggest internet companies and web hosts that rely on PHP an early head start on installing them. Weeks of backroom chatter and careful industry coordination kept the world — so far — from mass internet exploitation.

Governments began urging citizens and companies with websites to mitigate the risks on their end. Banks, retailers, gaming sites, online stores, hospitals and some government agencies pulled servers offline to patch. Security researchers warn a large number of systems worldwide remain unpatched and exposed to hacks and data theft.

What exactly happened?

Security researchers at Calif found the two bugs during a security audit of PHP's code earlier this year. PHP is free, open-source and has existed for decades, making it one of the most widely used web programming languages — running platforms like WordPress, Drupal, Joomla and MediaWiki, which powers Wikipedia.

The bugs were first discovered in 2024 but weren't considered exploitable at the time, so they went unpatched. Researchers recently found a way to weaponize them and alerted the PHP Foundation, which began fixing the flaws under a coordinated disclosure: information and patches were shared under a tightly guarded embargo to give large companies time to get ahead.

The takeaway: two dormant flaws sat in the internet's most popular web language for over a year before anyone could exploit them — and then everyone had to move at once.

Why are the bugs so serious?

PHP2Shell can be abused remotely over the internet without the victim clicking a link or opening a file. That's remote code execution — among the most damaging bug classes, because it grants a hacker anywhere in the world effectively full control of an affected, unpatched system.

Worse, these specific flaws allow unauthenticated access: no password, no credentials of any kind. A malicious hacker could plant malware to steal data or establish a long-term foothold to return to later.

Was AI used to find the bugs?

Calif participated in the Hack the Planet initiative run by OpenAI and cloud security giant Wiz, which verified Calif's proof-of-concept exploits. In its write-up, Calif said AI assisted with exploiting the bug, but the bulk of the work relied on knowledge the researchers already had — they knew PHP's codebase and exploitation history well.

"No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now," Calif wrote.

Did someone exploit the bugs early?

Yes. Amazon, whose scale gives it enormous visibility into online threats, said in a blog post it detected PHP2Shell exploitation about a week before the patches were available. Amazon said it wasn't clear how the hacker learned of the flaws, but told defenders to look for evidence of exploitation as early as October 17.

Theories vary. Open-source patches make a bug's location and fix immediately inspectable. There may have been a leak or a good-faith breakdown during the embargo. Hackers may have found the bugs independently or through espionage. The PHP Foundation blamed one company for pushing patches live hours before the embargo ended — but that doesn't explain a week of prior activity.

Weaponizing the bugs has been a challenge, though not impossible, which researchers say explains why mass exploitation hasn't materialized. But as of late Friday, Palo Alto Networks and Trail of Bits confirmed compromises and post-exploit activity on an as-yet-unknown target.

Did the internet dodge the worst?

It's early, but encouraging — no signs of mass exploitation yet. Cloudflare CEO Matthew Prince said this week that Cloudflare has seen an exponential number of exploit attempts following disclosure, a measure of how fast malicious actors are moving.

PHP isn't confined to web servers. It also runs in developer tools, command line and terminal packages, and components inside routers, storage devices and enterprise security gear like firewalls and VPNs. Smaller IT teams and sole developers will patch slowly, and companies that embed PHP in their own products will need time to update. Legacy systems with no update path could feel the ripple effects for years.

Will this happen again?

Probably. The precedent list is short and ugly: the 2016 Dyn botnet attack that slowed much of the web, the 2017 WannaCry ransomware that hit the UK's health system with leaked US hacking tools, and the 2024 CrowdStrike update failure that crashed most of the world's Windows computers at once.

PHP is "memory unsafe," vulnerable to an entire class of flaws that force software to leak sensitive data from memory. The National Security Agency says around 75% of all actively exploited vulnerabilities abuse memory-related flaws. That's driving a shift to memory-safe languages like Python, Rust and Swift — but a large chunk of the internet still runs PHP, legacy codecs, compression libraries and other decades-old software. AI tools, meanwhile, are making flaws easier to find. When those technologies break next, the implications for the web will be just as massive.