PHP2Shell Cyberattack Warning: Critical PHP Flaws Expose Websites as AI Speeds Up Hacking

A major cybersecurity discovery has raised fresh concerns about the safety of websites and the growing role of artificial intelligence in digital attacks. Researchers have identified critical vulnerabilities in PHP, a programming language used to build a substantial proportion of websites worldwide. The flaws, collectively known as PHP2Shell, could allow attackers to execute malicious code on vulnerable servers without first authenticating themselves.

The vulnerabilities were publicly disclosed on October 21, 2026, alongside security updates designed to address the problems. Researchers demonstrated that the flaws could be exploited against popular website platforms, including WordPress, Drupal and Joomla, even though the underlying weaknesses were in PHP itself rather than in those applications.

The discovery is particularly significant because artificial intelligence helped researchers identify and develop working exploits for flaws that had remained hidden for more than a decade. Tasks that once required highly specialised knowledge, repeated testing and extensive debugging can now be accelerated by advanced AI models.

For businesses, website administrators and ordinary internet users, the incident highlights two connected challenges: securing the software that powers the web and adapting to a cybersecurity environment in which AI can assist both defenders and attackers.

PHP2Shell is the name given to a group of critical vulnerabilities found in the core PHP engine. PHP is a server-side programming language used to generate dynamic web pages, process requests and support many content management systems, online services and business websites.

Because PHP is so widely deployed, a security weakness in its underlying engine can have consequences far beyond a single website or software product.

The reported vulnerabilities are tracked under two identifiers: CVE-2026-109618 and CVE-2026-109619. Both received critical severity ratings, with a CVSS v4.0 score of 9.2.

The flaws involve memory-safety problems associated with how PHP handles certain errors and manages internal data between requests. Under specific conditions, an attacker may be able to exploit the resulting memory corruption or access information left in a server process.

The potential consequences include:

These outcomes depend on the affected software, configuration and successful exploitation. Not every website running PHP will necessarily be compromised, but the severity and breadth of the underlying weaknesses make rapid remediation essential.

PHP provides the foundation for a large part of the web. It is used by WordPress, Drupal, Joomla and many other applications, including websites that handle customer accounts, online publishing, business information and e-commerce.

Researchers estimated that PHP powers around 70% of websites worldwide. That figure describes PHP's broad presence across the internet; it does not mean that 70% of all websites have been successfully attacked or that every website is equally vulnerable.

The important issue is that PHP2Shell affects the language runtime itself. A website can have well-written application code and still be exposed if it runs a vulnerable PHP version.

Researchers demonstrated remote code execution against representative deployments of WordPress, Drupal and Joomla. They also showed that the underlying weaknesses were not limited to these content management systems.

This makes software inventory particularly important. Organisations need to know which PHP versions are running across their websites, hosting accounts, containers, servers and third-party applications.

A business may have several separate PHP installations managed by different teams or hosting providers. Updating only the main website may leave another internet-facing service exposed.

The technical details involve memory management inside PHP, but the central issue can be explained without examining exploit code.

Computer programs use memory to store information while they process requests. That memory must be managed carefully so that the program does not continue using data after the relevant memory has been released or reused.

PHP2Shell involves two related classes of weaknesses.

The first vulnerability, CVE-2026-109618, involves a use-after-free condition associated with PHP's upload-progress handling and unserialisation processes. In certain circumstances, a fatal error can interrupt normal cleanup and leave internal state pointing to memory that is no longer valid. A subsequent request may then interact with that stale state.

The second vulnerability, CVE-2026-109619, involves another use-after-free issue linked to fatal-error backtraces and OPcache, PHP's performance optimisation system. Under specific conditions, internal state may persist after the memory supporting it has been released, allowing later processing to encounter invalid data.

These flaws can create opportunities for memory disclosure or corruption. Researchers combined complex exploitation techniques to demonstrate how the vulnerabilities could lead to remote code execution.

The important security lesson is that a weakness in a foundational software component can undermine applications built on top of it. Website owners cannot rely solely on application-level security when the underlying runtime is vulnerable.

One of the most consequential aspects of PHP2Shell is the role of advanced AI in the research process.

The vulnerable code had existed for more than a decade, yet developing a practical exploit required overcoming several technical challenges. Researchers needed to identify the underlying bugs, understand how memory was reused, chain separate weaknesses together and adapt the resulting exploit to different application environments.

AI tools helped accelerate these tasks. According to the research team, advanced models contributed to vulnerability discovery, exploit development, testing, debugging and validation of the fixes.

This is an important change in cybersecurity because the difficulty of exploiting a vulnerability has often provided a degree of protection. A flaw might be theoretically dangerous but too complicated or unreliable for most attackers to exploit in practice.

AI can reduce some of that complexity by helping researchers analyse large codebases, reason about program behaviour, generate test cases and troubleshoot failed approaches.

The result is not that AI automatically breaks into every vulnerable system. Rather, it can reduce the time and specialist effort required to turn a difficult technical weakness into a practical attack.

That shift changes how security teams need to assess risk. Vulnerabilities that were previously considered difficult to exploit may become more attractive targets when AI-assisted tools lower the barriers to exploitation.

The wider cybersecurity landscape is changing as AI agents and advanced language models become more capable of assisting with technical tasks.

AI can help defenders review source code, identify unusual activity, classify security alerts and investigate suspicious behaviour. The same general capabilities can also be misused to automate reconnaissance, search for weaknesses, generate malicious scripts and adapt attacks.

Recent reporting on AI-assisted cyber activity has raised concerns that attackers can use automated tools to target multiple organisations, move quickly between technical tasks and place additional pressure on security teams.

However, it is important to distinguish AI-assisted cybercrime from fully autonomous hacking. Many attacks still depend on human decisions, infrastructure, stolen credentials, misconfigurations or conventional malware. The involvement of an AI tool does not mean that the entire operation was independently planned and executed by a machine.

The more immediate concern is scale and speed. When AI helps attackers perform complex tasks more quickly, organisations may have less time to identify a vulnerability, assess exposure and deploy a patch before attempts to exploit it begin.

PHP2Shell illustrates this dual-use problem. AI helped security researchers discover and validate dangerous vulnerabilities, but the same improvements in technical capability could also help malicious actors adapt exploits to vulnerable environments.

Remote code execution, commonly abbreviated as RCE, is among the most serious categories of software vulnerability because it can allow an attacker to run commands or code on a remote system.

If an attacker successfully compromises a website server, the potential impact extends beyond the visible webpage.

Depending on the server's permissions and network access, a compromise could expose customer information, reveal application secrets, modify website content or create a foothold for further attacks. In some environments, the attacker might also attempt to access connected databases or other internal services.

For an online retailer, this could threaten website availability and the confidentiality of customer information. For a media organisation, it could affect publishing systems and editorial operations. For a small business, it could result in unexpected downtime and costly recovery work.

A compromised website may also be used to distribute malicious content or attack visitors. However, these consequences are possibilities rather than proof that every affected website has experienced a breach.

Organisations should therefore approach PHP2Shell as a critical patching priority while investigating any evidence of suspicious activity on potentially exposed systems.

The original PHP2Shell disclosure identified affected PHP versions dating back to PHP 5.4, with the vulnerabilities present across versions released over the past decade.

On October 21, 2026, the PHP development team published security updates for supported branches. The announced fixed versions were:

Organisations should confirm the correct fixed release for their particular environment and apply the updates through their normal software distribution or hosting provider.

PHP 8.1 and older versions have reached the end of life in the upstream PHP project. These versions may not receive direct security fixes from the PHP project, although some operating-system vendors and long-term support providers may supply backported patches.

Administrators using older PHP versions should confirm their vendor's security status and plan an upgrade to a supported release where necessary.

It is also important to remember that PHP may be bundled within containers, managed hosting services, appliances or third-party products. Patching a standalone PHP installation does not automatically update every bundled copy.

The most important response to PHP2Shell is to identify vulnerable systems and apply the appropriate security updates immediately. The PHP development team has stated that updating is the safe remediation approach for the original vulnerabilities.

Website owners and security teams should take the following steps:

1. Identify every PHP installation. Build an inventory covering production servers, staging environments, containers, hosting accounts and third-party systems.

2. Apply the security updates. Upgrade affected installations to the appropriate fixed release or install a verified vendor-provided patch.

3. Check internet-facing services first. Publicly accessible web servers and applications that process untrusted requests should receive urgent attention.

4. Review logs for suspicious activity. Look for unusual requests, unexplained server errors, unexpected processes, unfamiliar files or suspicious outbound network connections.

5. Investigate signs of compromise. Patching prevents exploitation of the original flaws, but it does not automatically remove malicious code or reverse a compromise that occurred earlier.

6. Review permissions and credentials. Ensure web processes have only the permissions they need. If evidence suggests sensitive credentials were exposed, rotate affected passwords, API keys and tokens after containing the incident.

7. Monitor third-party providers. Contact managed hosting providers and vendors to confirm that PHP components embedded in their services have been updated.

Security teams should use official advisories and their own environment's version information to verify remediation rather than relying on assumptions about which systems are affected.

On October 23, 2026, additional security information identified another PHP remote code execution vulnerability, tracked as CVE-2026-115560.

This is a separate issue from the two PHP2Shell vulnerabilities patched on October 21, and the earlier security updates do not address it. The reported attack path requires an uncommon combination of PHP configuration and application behaviour.

Pending a security update for this additional issue, the Canadian Centre for Cyber Security cited the PHP team's recommendation to disable the session upload-progress feature by setting session.upload_progress.enabled=0 where applicable.

Administrators should consult the latest official PHP and vendor advisories before making configuration changes. This additional finding reinforces why ongoing vulnerability monitoring matters even after an urgent patch has been installed.

Most people do not directly manage PHP servers, so the immediate technical response falls primarily to website owners, hosting providers, developers and IT security teams.

Nevertheless, ordinary users can be affected if a website they rely on is compromised. Depending on the incident, attackers might attempt to steal information, distribute malicious content or disrupt an online service.

Users should continue following standard digital security practices: use unique passwords, enable multifactor authentication where available, keep devices and browsers updated, and be cautious about unexpected links or requests for confidential information.

Businesses should also communicate clearly if an incident affects customer information or service availability, following applicable legal and regulatory requirements.

There is no need for users to assume that every website built with PHP has been hacked. The appropriate response is to recognise the seriousness of the vulnerability while allowing administrators and security professionals to apply and verify the necessary fixes.

PHP2Shell is a significant reminder that vulnerabilities in widely used software can create risks across a broad digital ecosystem. The two original flaws could enable remote code execution or expose sensitive process memory, and their discovery has prompted urgent calls for patching.

The incident also highlights how artificial intelligence is reshaping cybersecurity. AI tools can help researchers discover flaws that have remained hidden for years, but they can also lower the effort required to develop and adapt attacks.

For website owners, the practical priority is clear: inventory PHP installations, apply the correct security updates, verify third-party components and investigate suspicious activity. Organisations should also monitor new advisories because patching one set of vulnerabilities does not guarantee that all risks have disappeared.

As AI-assisted security research and cyberattacks continue to evolve, rapid patch management, effective monitoring and collaboration between software developers and defenders will be essential to keeping the internet safer.