The PHP scripting language—which quietly powers roughly 70% of the web—disclosed two critical remote-code-execution flaws on October 21, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. With details leaked a day early, operators rushed emergency patches (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) while Cloudflare's CTO warned that early exploitation attempts were already hitting sensors and that firewall mitigations were a stopgap only. AWS analysts say at least one actor started exploiting the bugs on October 17, four days before public disclosure, and the flaws are now being 'broadly exploited'—with researchers tying attempts to a Mirai botnet and demonstrating an ASLR bypass. Japanese banks and airlines took digital services offline to patch, government sites across Europe went dark, and Wikipedia and the Internet Archive both experienced outages as administrators pulled PHP-based systems offline as a precaution. As Anthropic executives warn that AI is ushering in an era of rapid-fire software vulnerabilities that will 'get a lot worse before they get better,' the episode is a stark reminder of how much critical infrastructure runs on aging, under-maintained code: patches cover only PHP 8.2 and newer, leaving legacy and abandoned deployments exposed.
Last Updated: