Last week, website owners around the world had a very bad Tuesday.
On October 20, 2026, details of two critical flaws in PHP leaked online, two days before they were supposed to be made public. PHP runs about 70% of all websites, so the leak set off a global race between people patching servers and people trying to break into them. Some organizations, including the Dutch National Cyber Security Centre, simply took their websites offline until they could patch.
The flaws now have a name worthy of a horror movie: PHP2Shell.
What happened?
PHP2Shell is two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity. Together, they let an attacker run their own code on a vulnerable server without anyone clicking anything.
The bugs live in the way PHP handles memory while it reads incoming web requests:
- CVE-2026-109618: when a server runs out of memory partway through a request, PHP can treat half-finished data as if it were complete.
- CVE-2026-109619: leftover data from one visitor's request can linger in memory after it should be gone, where the next request can reach it.
Here's what makes it so nasty: this all happens before a website's own code runs. Firewalls inside your app, framework security, WordPress plugins, none of them get a chance to help. A carefully built custom platform was just as exposed as a default install.
The twist: AI found it
The flaws were discovered in August by Ryan Austin, a researcher at security firm Calif, using OpenAI's GPT-5.6 Sol during an audit of PHP's source code. Researchers at Wiz independently found more ways to exploit them. The weakness had been noticed decades earlier but was considered too difficult to exploit. AI changed that.
It's a good reminder that AI is now speeding up both sides: defenders finding bugs, and attackers using them.
Was anyone hacked
PHP released fixes on October 21, a day earlier than planned because of the leak. Security firms including watchTowr, Patchstack, and Cloudflare reported exploitation attempts around the same time, and Patchstack said it confirmed several real incidents. At the time of writing, there's no reliable count of compromised sites, and the "70%" figure refers to how much of the web runs PHP, not how much was hacked.
The bigger worry is old servers. PHP 8.1 and older won't get an official fix, and one scan found around 884,000 public servers still advertising those versions.
If you run PHP: upgrade to 8.5.12,8.4.27, 8.3.36, or 8.2.35, restart your web server or PHP-FPM, and check the version with php -v. If you're on PHP 8.1 or older, it's time to upgrade properly. And not that PHP 8.2 reaches end of life on December 31, 2026.
How OpenCore Group handles issues like this
No one can stop a bug from existing inside a language like PHP. What we can control is how exposed our clients are, and how quickly we respond when something like this happens. That's where we put our effort.
We keep software on supported versions. We don't leave client platforms running on outdated, end-of-life runtimes. Supported versions get security fixes; between "patch and move on" and "emergency rebuild."
We watch for security advisories. Our team tracks security announcements for the languages, frameworks, and libraries our clients' products depend on, so we hear about problems early.
We can patch quickly. Because our deployments are automated and repeatable, rolling out an urgent update is a routine task, not a weekend-long project.
We layer our defences. Web application firewalls, network-level protections, and limited server permissions mean a single flaw is less likely to turn into a full breach. Cloudflare, for example, had protections against PHP2Shell in place nine hours before the public disclosure.
We limit the damage if something gets through. Applications run with least access they need, secrets are kept out of code, and backups are tested, so one compromised component doesn't put everything at risk.
We review and monitor. Every change goes through code review and automated security checks, and we monitor logs so unusual activity is spotted fast.
PHP2Shell won't be the last bug of its kind, especially now that AI is finding them faster. The teams that come through these moments calmly are the ones that did the boring work beforehand.
Not sure if your platform is exposed to PHP2Shell? Talk to OpenCore Group →
References
- Kaspersky: CVE-2026-109618 and CVE-2026-109619 explained
- SecurityWeek: PHP2Shell patches land as first exploitation attempts hit sensors
- Techzine: Why PHP2Shell affects every company
- CNN: AI helped find a critical security flaw affecting 70% of the internet
- The Wall Street Journal (via To Vima): AI found a bug that puts up to 70% of websites at risk
- SOCRadar: PHP2Shell timeline and exploitation status
- Health-ISAC vulnerability bulletin
