If your website runs on PHP, and a huge share of the web does, this is the story to act on today.
Two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, are now being called PHP2Shell. Both allow remote code execution and both are rated 9.2 on the CVSS 4.0 scale. Details surfaced publicly on 20 October, ahead of their planned disclosure, and the PHP security team pushed out an emergency release on 21 October.
Both bugs come down to memory handling. One involves out-of-memory errors leaving request memory uninitialised, which attackers can trigger to run their own code. The other leaves global memory pointing to freed memory that later requests can read or branch on. TechTarget reports that OpenAI’s GPT-5.6 Sol model helped researchers detect the underlying flaws.
What makes this nasty is where the bugs live. They’re in PHP, not in a plugin or framework on top of it. Palo Alto Networks says that on Apache setups using mod_php, unauthenticated code execution has been demonstrated before application code even starts running. According to the PHP Foundation, as quoted by TechTarget, every PHP installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Attackers have moved quickly. In an update on 23 October, Unit 42 said it saw attackers using agentic AI platforms after breaking in. In one case involving a government body in Europe, they reached password hashes and multi-factor authentication secrets within two hours, set up an NTLM-relay tunnel into Active Directory and attempted to escalate to Domain Admin. Unit 42 says at least one European government took its website offline as a precaution.
The exposure is enormous. Palo Alto’s Cortex Xpanse telemetry has identified more than 22.6 million internet-exposed instances that may be vulnerable.
The fix is clear: Palo Alto advises upgrading immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Why it matters
WordPress runs on PHP, so this touches millions of business websites, including small ones. If you run a site, check your PHP version today or ask your host whether it’s been patched to one of the fixed releases. If you can’t confirm, assume you’re exposed. The AI angle matters too: AI helped find these bugs, and attackers are already using AI agents to exploit them fast. Patching speed is now the whole game.
Sources: Unit 42, Palo Alto Networks, Palo Alto Networks, TechTarget. Written by the xRapid Media LLP team.