PHP issued emergency fixes today for two critical flaws that permit remote code execution. The flaws, CVE-2026-109618 and CVE-2026-109619, are jointly called PHP2Shell. PHP powers 70% of websites worldwide. More than one-third of the web remained unpatched at publication time.
PHP2Shell allows an attacker without authentication to execute code on a web server and send faulty output to a user's browser. Exploitation can happen before the website executes the website's own code. PHP handles website backend programming on servers rather than inside browsers. PHP sends generated HTML or other dynamic data to browsers.
Official patched releases cover only PHP 8.2 and later, leaving more than one-third of PHP websites without a patch. Backports for older versions, from 7.4 through 8.1, began appearing by midday. One estimate puts more than 800,000 internet hosts, serving millions of websites, on a PHP branch too old to receive any fix. Patched releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. However, PHP 7 still runs on 27% of PHP sites and remains unpatched. PHP 5 runs on 7.7% of PHP sites and also remains unpatched.
A security researcher discovered the bug using OpenAI's GPT-5.6 Sol model during an OpenAI-funded audit in August. The researcher belonged to Calif, a partner in OpenAI's Patch the Planet program. The program combines frontier models with cybersecurity assessments by human experts. Calif CEO Thai Duong told The Wall Street Journal that researchers had identified this class of bug decades earlier but considered exploitation too difficult. However, AI hackers have now determined how to take control of server memory using a few dozen requests. Wiz, a Google Cloud division, independently confirmed the flaws. A Wiz co-founder described PHP2Shell as "the most severe AI vulnerability that was ever found" and said humans probably would never have discovered PHP2Shell.
Cloudflare CTO Dane Knecht reported live exploit vectors affecting every customer, including customers on free plans. Cloudflare deployed an emergency temporary measure overnight. Cloudflare announced additional patches a few hours later.
Finland's state IT center suspended several government web services as a precaution. In the Netherlands, NotuBiz's council information websites for local governments went offline. MijnOverheid and the Netherlands parliament's website subsequently went offline. GoDaddy urged customers to upgrade.
Critical PHP Vulnerability Affects 70% of Websites, Leaving Millions Unpatched
ProtosShare
Summary
A critical PHP vulnerability named PHP2Shell impacts 70% of websites, enabling remote code execution without authentication. The flaw was fixed in PHP 8.2 and newer, but over one-third of sites remain unpatched. Older versions, including PHP 7 and PHP 5, still used by 34.7% of PHP sites, remain vulnerable. A researcher using OpenAI’s GPT-5.6 Sol model found the issue. Cloudflare reported active attacks and deployed emergency blocks. Finland and the Netherlands paused government services. With global liquidity and crypto markets under pressure, such vulnerabilities could be exploited for CFT violations.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.