Two critical PHP bugs allow remote code execution, and the 70% claim comes from Wiz without a source
The PHP2Shell vulnerabilities, patched on 21 October, let attackers run code on web servers without logging in. TF gets into the two flaws, the role of AI and the steps admins should take, ASAP.
What’s Happening & Why It Matters
The Two Flaws
PHP released security updates on 21 October for two critical bugs, tracked as CVE-2026-109618 and CVE-2026-109619, Help Net Security reports. Both carry a CVSS score of 9.2, according to SecurityWeek. The flaws are in the core PHP engine, so an application needs no coding error to be exposed.
CVE-2026-109618 involves out-of-memory handling leaving request data half-built. CVE-2026-109619 involves stale internal state a later request on the same worker can reuse. Wiz describes both as memory-safety bugs.
Who Is Affected
Wiz says almost every PHP version is affected, back to PHP 5.4. The risk covers PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, according to Help Net Security. The mod_php setups face the greatest danger.
Fixes arrived in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP security team released source backports for 7.4, 8.0 and 8.1. Updating website code or plugins does not fix the flaws. The PHP software needs the update.
How AI Helped
Wiz Research says the team used Gemini 4 Argon and GPT-5.6 Sol, along with Wiz Atlas, in the work. Wiz credits Gemini with help in finding the bug, building the exploit, detecting attacks and validating the patch. One researcher finished in a week what Wiz says once took a team months.
Reports differ on who found the flaws. Cloudflare lists Calif.io, Wiz, OpenAI and Quarkslab as the disclosing parties. SecurityWeek names no discoverer and cites two public write-ups. Help Net Security credits Wiz with the analysis but does not say who found the bugs first. TF cannot confirm AI alone found the flaws.
The 70%
Wiz says PHP powers 70% of all websites, and its title says the flaws affect 70% of the internet. The post cites no source for the figure. Exposure varies with the version, the configuration and the memory layout of each server.
Wiz says full code execution needs several chained bugs and tuning for each target. Its summary calls some attacks easy, while the body describes a complex chain. TF treats the 70% figure as unverified.
Exploitation Risk
Details leaked before the planned coordinated disclosure, SecurityWeek reports. WatchTowr says the firm reproduced CVE-2026-109618 and confirms the flaws are real. Sansec expected mass exploitation within 15 minutes of the patch release. SecurityWeek’s update says firms saw exploitation attempts, including some before the fixes arrived.
Cloudflare saw attack traffic against its customers, with attackers mutating payloads to evade protection. Cloudflare began default WAF protection for Free and paid customers at 03:02 UTC on 21 October. Help Net Security says the UK National Cyber Security Centre urges taking offline any system without an immediate fix. TF covered other fast-moving threats in TF Cybercrime Round-Up: 6-11 October 2026.
What Admins Need to Do
Install the PHP update first. Wiz calls the update the sole complete fix. Hosting customers should ask providers to patch. Keep Cloudflare or another WAF on during patching.
Watch for odd multipart requests, memory-limit errors, repeated HTTP 500 responses, oversized session cookies and unexplained worker restarts. Cloudflare says limiting upload sizes reduces exposure but does not replace the fix.
My take: Help Net Security calls the flaws decades old, and Wiz says AI shortened the time from bug to working exploit. Defenders should expect more bugs to surface the same way. Patch speed will decide outcomes, and many PHP 8.1 and older servers lack official support. Unsupported versions need vendor backports or retirement.
TF Summary: What’s Next
Admins must update PHP or apply vendor backports today. Hosts and distributions will send fixes to customers over the week. Researchers will publish more exploit detail and detection rules. Attackers will scan for unpatched servers.
MY FORECAST: Mass scanning and exploitation of unpatched PHP servers will continue for weeks. At least one large hosting provider will report compromised customer sites. Regulators will urge patching in public advisories. More vendors will disclose AI-assisted vulnerability research by early 2027.
Related Stories
- TF Cybercrime Round-Up: 6-11 October 2026
- OpenAI Hacks Crypto Wallet, More Websites
- Anthropic: Models Will Replicate Themselves in Months
- Google Cloud London Outage Disrupts Revolut and UK Banks, as ING Germany Reports Problems
- US Bars DeepSeek from Federal Civilian Agencies and Procurement