PHP Vulnerability 2026: The 2-Year-Old Bug an AI Found That Took Government Sites Offline

Описание: The PHP vulnerability of 2026, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), made governments take their own websites offline on patch day. What is PHP, what is PHP used for, how can one web request lead to remote code execution, and why did it take an AI to turn a two-year-old warning into a working exploit? Here's the PHP security update explained, with what's confirmed and what's only claimed.

As of October 21, 2026.
CONFIRMED: the PHP security team announced an emergency release on Oct 20 and shipped fixes on Oct 21 at 14:00 UTC: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP rates both CVEs 9.2 (CVSS v4). PHP 8.1 and older get no official fix (minimal source backports exist for 7.4, 8.0 and 8.1). Affected: PHP serving web requests (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed); PHP says risk is highest on mod_php. The UK NCSC said to patch or take systems offline. Japan's Prime Minister Sanae Takaichi posted on X: "We have an urgent request for everyone to take action tonight."
REPORTED: the Netherlands, Finland, France and Australia took some government services offline to patch (The National).
CLAIMED, NOT INDEPENDENTLY CONFIRMED: Cloudflare says it saw early attacks before the patch. OpenAI says the firm Calif found one flaw with its GPT-5.6 Sol model (reported Aug 11, 2026, the same day as OpenAI's own report); Wiz found both independently and says frontier AI models turned a longstanding flaw into an exploit.
ESTIMATES: exposed PHP hosts range from about 1.3 million (Silas Cutler) to 1.9 million (Shodan, Henk Poley) to over 5.1 million (VirusTotal). Methods differ.
NOTE: updating WordPress or Laravel does not update PHP itself. Check the PHP version your host runs. Our worker diagram is simplified, not the exact code path.

Chapters
0:00 PHP vulnerability 2026: government sites offline
0:28 The PHP security update, hour by hour
1:09 What is PHP?
1:22 How PHP2Shell works (remote code execution)
2:00 The twist: an AI found it
2:28 Confirmed vs claimed
2:45 Exposed servers and your PHP version

Sources
BleepingComputer, PHP ships emergency patches for critical PHP2Shell flaws (Oct 21, 2026): https://www.bleepingcomputer.com/news...
Help Net Security, PHP2Shell: Critical PHP vulnerabilities patched (Oct 21, 2026): https://www.helpnetsecurity.com/2026/...
Tenable, php2shell FAQ: https://www.tenable.com/blog/php2shel...
The Hacker News, PHP2Shell: what actually protects you: https://thehackernews.com/2026/10/php...
The National, PHP vulnerability: websites go offline (Oct 21, 2026): https://www.thenationalnews.com/futur...
OfficeChai, Japan's Prime Minister and FBI warnings: https://officechai.com/stories/japans...
OfficeChai, OpenAI's GPT-5.6 Sol helped flag the PHP bug: https://officechai.com/ai/openais-gpt...

Photos via Wikimedia Commons: Cabinet Public Affairs Office of Japan, David Kernan (CC BY 4.0); Carl Lender, Alan Levine (CC BY 2.0); Derrick Coetzee, lmonk72, Sai Kiran Anagani (CC0); PHP logo by Colin Viebrock (public domain). Server and code photos are file photos.

#PHP #PHP2Shell #CyberSecurity #WordPress #PHPVulnerability

Explainers for general information only, not security advice for your systems; claims as reported at time of publishing; not affiliated with any company or agency shown; spotted an error? Comment and we'll pin a correction.