ZDNET’s key takeaways
- The release of critical bugs in PHP leads to an urgent rush to patch.
- Cybercriminals will likely weaponize this vulnerability.
- Organizations should act now to prevent exploitation.
A flaw in PHP has sparked a worldwide scramble to patch vulnerable websites, and now further instructions have been issued by the PHP Project to prevent “an unlikely Remote Code Execution (RCE) Vector” and PHP2Shell attacks.
What is PHP2Shell?
PHP2Shell refers to a pair of PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which have each earned a critical severity score of 9.2 and affect most PHP builds. The PHP Project released patches to fix these bugs on Wednesday, and the critical nature of these flaws prompted a worldwide scramble to apply PHP’s fixes as quickly as possible.
Why the rush? Because PHP (a recursive acronym for Hypertext Preprocessor) is a general-purpose programming language that provides the backbone for many of the websites and services we access every day – everything from WordPress websites to e-commerce platforms.
According to the Wiz security team, which discovered the vulnerabilities with the help of AI, PHP can be found on 70% of the world’s websites.
Urgent stains and quick attacks
“This vulnerability involves memory leaks and unauthenticated remote code execution in PHP itself, regardless of the application running on it, putting any affected website at immediate risk,” says Wiz.
Armed with these vulnerabilities and targeting an unpatched system, attackers can execute code on affected servers or read sensitive process memory, stealing data and infiltrating corporate networks in the process.
Also: AI a ‘force multiplier’ for low-skilled threat actors
Wiz goes on to make an interesting point: While AI has helped in discovering these vulnerabilities, AI could also be used to exploit them. Developing an attack chain and demonstrating the exploitability of these bugs “requires an extraordinarily complex chain of steps,” according to the researchers, which are “at the edge of what human researchers can practically achieve.” However, Frontier AI models have significantly reduced this barrier, turning a longstanding flaw into an exploit.
According to Amazon Threat Intelligence, attempts to exploit P2P2Shell had already occurred four days before the difficulties were made public. Proof-of-concept works began hours later. A threat actor linked to P2P2Shell attack chains is trying to deploy a Mirai-style botnet, and Cloudflare CEO Matthew Prince says Cloudflare’s network is now hosting “millions” of exploit attempts.
Further guidance
In an advisory published on October 23, the PHP Project urged organizations to do the following: set session.upload_progress.enabled=0 until the next round of scheduled bug fixes in PHP. While already listed as a mitigation in the October 21 release, now that there has been time to further investigate PHP2Shell, applying this mitigation may protect against another Remote Code Execution (RCE) vector.
Also: Best VPN Services: Expertly Tested
Because this RCE, now recorded as CVE-2026-115560, requires unusual configuration and application code setup, the attack vector is considered “unlikely”; therefore, the reduction will be sufficient until it is handled by the PHP Project in the regular release cycle.
“An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch to php at runtime with ini_set() before calling session_start(),” the PHP Project said in its advisory. “Session upload progress must also still be enabled. Applications that never modify the serialized handler at runtime can keep the feature enabled.”
How organizations should act
PHP Project urges users to take immediate action by updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If it is not possible to patch immediately, organizations can implement mitigations that are included in its advice.
The National Security Agency (NSA) has advised “increased awareness” of PHP2Shell over the next few weeks, saying that any and all vendor-issued patches related to PHP2Shell should be prioritized. Companies should also consider applying mitigating steps, such as enhanced logging and replacing end-of-life PHP packages, if appropriate.
Also: 7 privacy settings I change ASAP on every new phone
“All users should immediately take inventory, where feasible, of hardware and software services that depend on currently vulnerable PHP versions,” the agency added. “Vigilance in applying patches related to these systems is important.”
Speaking to ZDNET, Matthew Weier O’Phinney, principal product manager of Perforce Zend and OpenLogic, said that most open source software and commercial LTS software distributions have patches available either at the time of the coordinated release or within a few hours after, and if you use PHP, there is likely a fix available for you now.
“Assuming you’re using one of those, using your system package manager to update is a quick fix,” O’Phinney added.