This is PHP2Shell, the bug that threatens seven out of ten websites

Two critical vulnerabilities in the PHP programming language, collectively dubbed PHP2Shell, threaten approximately 70 percent of all websites whose server-side scripting language is known. The PHP project released fixed versions on Wednesday, accompanied by an unusual advisory stating that no configuration adjustment offers complete protection. Users must update to the latest versions of the language to secure their systems, a task that many organizations may struggle to perform quickly. These flaws allow attackers to send requests to a web server and execute arbitrary code directly on the host machine without requiring valid user credentials or passwords. This capability effectively grants remote shell access, enabling the total compromise of affected infrastructure. The vulnerabilities affect the core memory management and error handling mechanisms of PHP. The first flaw, identified as CVE-2026-109618, occurs when the interpreter reaches its configured memory limit during request processing. When this limit is hit, PHP abruptly halts execution. If this interruption happens while internal data structures are being built, they remain partially constructed. During the subsequent cleanup phase, the system treats these incomplete structures as fully formed. Attackers can trigger this condition using requests with undeclared sizes or other methods that saturate the process and corrupt memory, leading to the execution of malicious code. The second vulnerability, CVE-2026-109619, exploits the fact that PHP often reuses the same process for successive requests. If an error interrupts a request at a specific moment, residual data, such as session information or error states, may point to memory that has already been freed. The next incoming request utilizes these stale pointers before they are properly cleared. With careful manipulation of memory, an attacker can leverage this state to execute unauthorized commands. Both vulnerabilities carry a Common Vulnerability Scoring System rating of 9.2 out of 10, indicating severe risk. While exploitation is not trivial and may require thousands of attempts to succeed, the potential impact allows for full server takeover, data theft, and website defacement. Three independent teams discovered the bugs between late July and August 2026. The flaws had existed in the PHP codebase for more than a decade. All three groups utilized artificial intelligence tools in their discovery process. The security firm Calif and OpenAI’s security team employed the GPT-5.6 Sol model. Wiz, owned by Google, combined that model with Gemini 4 Argon and a proprietary tool. According to Wiz, the use of AI allowed a single researcher to accomplish in one week what would previously have taken months for a specialized team. The discoveries were kept confidential while the PHP team developed patches. However, a message posted on the Hacker News forum on Tuesday revealed the existence of the flaws, forcing the PHP project to advance the publication of the fixes by one day. Security experts warned that the situation is urgent because artificial intelligence significantly reduces the time between discovering a vulnerability and deploying an attack. Cloudflare reported detecting early attempts to exploit the weaknesses even before the official patches were available. Dane Knecht, Chief Technology Officer at Cloudflare, stated that the company was observing emerging attacks and updating mitigation strategies as new attack vectors appeared. Unit 42, the research division of Palo Alto Networks, estimated that over 22.6 million web applications and servers are exposed to these risks. Only active support branches of PHP, version 8.2 and later, receive complete patches. It is common for many applications, particularly enterprise software, to run older, unsupported versions. Government agencies and major institutions responded swiftly to the threat. The German Federal Office for Information Security issued an official cybersecurity warning, classifying the risk level as exceptionally high. The agency advised operators to disconnect servers from the internet temporarily if immediate patching was not possible. Similar warnings were issued by authorities in Australia, Japan, and several European nations. Some government websites were taken offline to prevent potential breaches. For instance, the website of the Paris Police Prefecture in France was disabled following the detection of the critical vulnerability. The University of Barcelona closed its internet connections as a precautionary measure. The Wikimedia Foundation, which operates Wikipedia, stated that it had taken down several systems until they could be safely patched. The widespread reliance on PHP makes the scope of the issue vast. Major content management systems, including WordPress, Drupal, Joomla, Moodle, and TYPO3, depend on the language. Experts estimate that between 400 million and 500 million websites globally operate on WordPress alone. Other popular platforms like Magento also utilize PHP. The PHP Foundation urged all users to update immediately, emphasizing that running the current version is imperative. The release highlights the growing role of automated tools in both finding and exploiting complex software defects. As organizations race to apply updates, the exposure window remains open for those unable to act instantly. The incident serves as a test case for how rapidly modern threats can propagate through foundational web technologies.