On Wednesday, a long-standing open-source web technology known as PHP was close to causing widespread internet disruption due to two vulnerabilities that had been dormant for years until researchers discovered ways to exploit them.
These vulnerabilities, identified as PHP2Shell and designated as CVE-2026-109618 and CVE-2026-109619, enable individuals with knowledge of the exploits to infiltrate systems that run PHP, such as websites and servers, without requiring a password to access or alter data.
This situation prompted urgent responses from millions worldwide as they rushed to update their systems to avoid potential exploitation by malicious hackers.
The PHP Foundation, responsible for maintaining the PHP software, released fixes on Wednesday to address the issues, which prevent attacks on web-facing servers. Prior to the public announcement, the foundation notified major internet companies and web hosts dependent on PHP, giving them an advantage in implementing the necessary updates.
Thanks to weeks of covert collaboration across the tech industry, there has, thus far, been no major exploitation reported, although governments began advising citizens and businesses with websites to take precautions immediately. Numerous sectors, including banks, e-commerce platforms, gaming sites, and healthcare facilities, temporarily took their websites offline to implement the updates.
However, experts caution that the threat is still present, with numerous systems worldwide unpatched and at risk for hacks and data breaches.
This event likelihood won’t be the last concerning internet software, as some experts predict that the rise of artificial intelligence could swiftly uncover more hidden vulnerabilities open to exploitation.
What transpired?
Security researchers at Calif discovered two vulnerabilities within PHP, a programming language extensively utilized globally for web development, both online and on local networks, like intranets.
As an open-source platform, PHP is freely accessible for various uses, contributing to its popularity as one of the dominant web programming languages today.
While the two vulnerabilities were initially detected in 2024, they weren’t deemed exploitable at that time, leading to no patches being released. Recent discoveries led researchers to raise alerts with the PHP Foundation for necessary fixes.
Upon notification from Calif, the PHP Foundation commenced its bug-fixing efforts and coordinated disclosure by providing information and patches regarding the vulnerabilities under a confidential embargo, allowing significant firms to prepare for the fixes.
Why are these vulnerabilities critical?
PHP2Shell poses a significant threat since it can be exploited remotely via the internet without requiring victims to interact with malicious content, known as remote code execution. This type of exploit is highly damaging as it can grant hackers comprehensive control over affected systems without needing any credentials.
Worse still, these specific PHP vulnerabilities allow entry into any unpatched system online without requiring any authentication, enabling malicious actors to install malware, steal information, or establish long-term access for future exploitation.
What led to 70% of the web being at risk?
These vulnerabilities are especially hazardous because PHP is widely adopted, primarily due to its cost-effectiveness and ease of use, and it has been in existence for many years. Approximately 70% of online platforms utilize PHP, although its prevalence has gradually been declining as newer, more secure programming languages emerge.
Given its popularity, numerous well-known websites, such as WordPress and Drupal, rely on PHP. PHP represents a part of many aging technologies that continue to serve critical roles on the internet, often maintained by unpaid open-source contributors who cannot afford extensive security assessments.
Was AI involved in discovering the vulnerabilities?
The vulnerabilities were uncovered by researchers from Calif as part of a security audit of PHP’s code, which was facilitated by the Hack the Planet initiative led by OpenAI and cloud security firm Wiz. These entities confirmed the exploits that Calif developed.
In Calif’s comprehensive report, they noted that while AI aided in leveraging the vulnerabilities, the majority of the groundwork was built upon the researchers’ pre-existing knowledge of PHP’s codebase and its history of exploitation.
Why were these vulnerabilities exploited prior to the disclosure?
Despite attempts to keep information about the vulnerabilities confidential until Wednesday, there are indications that some exploitation of PHP2Shell occurred before the official patch release.
Amazon reported having detected exploitation of PHP2Shell roughly a week before the patches were publicly available, implying that someone had prior knowledge of the vulnerabilities. The specifics on how this information was obtained remain unclear, but evidence suggests exploitation began around October 17.
Several theories have surfaced regarding this development. Once a vulnerability is patched, the patch’s details can often be directly inferred, particularly since PHP is open-source, making it accessible and scrutinizable. While exploiting weaknesses is challenging, understanding the vulnerability and its fixes can facilitate developing targeted attacks.
A possible information leak could have occurred due to a miscommunication during the embargo or hackers might have preemptively discovered the bugs. The PHP Foundation pointed to one company for prematurely releasing patches, but this does not explain the exploitation detected earlier by Amazon.
Experts note that weaponizing such bugs usually involves considerable effort, which accounts for the lack of widespread exploitation until now. However, confirmations of compromises related to the PHP vulnerabilities have since emerged.
Did the large-scale shutdowns mitigate the worst impact?
It remains early in the response, but encouragingly, there have not been signs of widespread exploitation yet, although risks still exist.
Matthew Prince, CEO of Cloudflare, reported a significant increase in attempts to exploit these vulnerabilities following their revelation, highlighting how eagerly malicious actors are looking to capitalize on these weaknesses.
PHP is utilized not only on web servers but is also part of various developer tools, command-line applications, and software used in routers, storage devices, and enterprise security systems.
Smaller IT teams and independent developers may be slower to apply updates, which could prolong the risk of exploitation. Additionally, companies integrating PHP into their products will also need to update their systems. As more systems go through updates, the risk will decrease, although ramifications from these vulnerabilities may linger for years, especially in legacy systems lacking update capabilities.
Is this a precursor to future incidents?
This incident marked a rare dramatic day in the realm of cybersecurity, akin to past events that have disrupted large parts of the internet. While it seems we narrowly avoided an extensive crisis this time, it is unlikely to be the last major event affecting the web, particularly given the vulnerabilities tied to aging technology.
Many legacy applications share inherent weaknesses that haven’t yet been identified, and the introduction of AI tools could further expedite the discovery process for flaws. PHP, like many historical web languages, is characterized as “memory unsafe,” making it susceptible to a broad array of vulnerabilities that can exfiltrate sensitive data from memory storage. Reports indicate that around 75% of all actively exploited vulnerabilities involve memory-related flaws, reinforcing their prevalence among attackers.
This situation has sparked movements towards adopting memory-safe programming languages such as Python, Rust, and Swift, which mitigate exploitation risks inherent in legacy languages. Yet, substantial portions of the internet still rely on outdated technologies like PHP and other software from previous decades, which poses significant risks when issues surface.
