SPECIAL REPORT · PHP2SHELL · CVE-2026-109618 / 109619
About 70% of websites run on PHP. On 2026-10-21, PHP issued emergency patches for two CVSS 9.2 vulnerabilities. They let an unauthenticated attacker run code on a server, and almost every release since 5.4 was affected before the patches. This page explains what you need to know and do now, and why the next incident will move even faster.
Resume esta página con IA
THE 30-SECOND BRIEF
Two memory-safety flaws were found in PHP core. CVE-2026-109618 affects cleanup during an out-of-memory condition. CVE-2026-109619 involves global state left behind after a request ends. Both allow unauthenticated remote code execution. The second can also leak passwords, tokens, and keys from other requests.
Official PHP advisoryAny internet-facing PHP service may be exposed, including PHP-FPM, Apache mod_php (the highest risk), php-cgi, FrankenPHP, and LiteSpeed. WordPress, Drupal, Joomla, and Magento were demonstration targets. Even Hello World is affected. Devices and admin panels with embedded PHP are also in scope.
NCSC-NL affected products listThe vulnerabilities score 9.2 under CVSS 4.0 and 9.8 under CVSS 3.1. Wiz called them some of the most severe vulnerabilities in PHP's history. CISA in the US, the UK's NCSC, Australia's ACSC, and Taiwan's Administration for Cyber Security (Ministry of Digital Affairs) issued alerts within a day.
NVDUpdate to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Then restart Apache, PHP-FPM, and long-running workers. Versions 7.4, 8.0, and 8.1 are no longer supported and received only a minimal source backport, so you must rely on your distribution or LTS vendor. Updating WordPress or its plugins will not help because the flaw is in the runtime underneath.
The PHP FoundationThe identifiers leaked the day before the patches, and proof-of-concept material is circulating. Cloudflare saw attacks before public disclosure and watched attackers mutate payloads in real time to bypass rules. Government websites in the Netherlands, Finland, and France went offline before patches were available. CISA had not added the flaws to its Known Exploited Vulnerabilities Catalog in the 10/21 release.
CloudflareTIMELINE
The first twenty-two years moved at the pace of human researchers. The final three months moved at agent speed.
2004
Stefan Esser found the first remote vulnerability in PHP's memory-limit handling. The root of this class of issue was already present.
2020
A related issue was reported again, but no one could prove it was exploitable.
2024
PHP's first external audit in years, funded by the Sovereign Tech Agency, coordinated by OSTIF, and conducted by Quarkslab, found a related out-of-memory issue. No one could prove it was exploitable, and the patch took several months. The PHP Foundation later called this a structural failure.
Early 2026
PHP partnered with Alpha-Omega to scan the codebase using Anthropic's Claude Mythos. OpenAI's Daybreak Red later joined to validate reports.
2026-07-30
OpenAI invited security research firm Calif to join Patch the Planet, with PHP selected as a high-impact target.
2026-08-01
With help from GPT-5.6 Sol, Calif researcher Ryan Austin found several paths to remote code execution only days into the audit. The team had not expected a major finding because every lab had already audited the target with AI.
2026-08-11
Calif reported the first vulnerability to PHP. OpenAI independently reported the same root cause. From that day, remediation became the top priority for every member of The PHP Foundation's security team.
2026-08-19
Wiz Research found the first vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. Within two days, the team confirmed unauthenticated remote code execution on Drupal and WordPress, then reported it to the PHP security team on 8/24.
2026-09-18
OpenAI reported more attack vectors. PHP confirmed all reports on 9/21 and began coordinating the patches.
2026-10-20
At about 15:00 UTC, both CVE identifiers appeared on Hacker News with an incorrect date and an incorrect 10.0 score. PHP issued an advance notice at 19:30 UTC and moved the release from 10/22 to 10/21. Calif accidentally published a short proof-of-concept video that evening. It was deleted, but copies had already spread.
2026-10-21 03:02 UTC
About 9 hours before public disclosure, Cloudflare automatically enabled protection for every plan, including its free plan. It also saw attackers mutate payloads in an attempt to bypass the protection.
2026-10-21 07:41 UTC
Chainguard released patched images more than 6 hours early, allowing attackers to study the binary differences and infer the fix.
2026-10-21 14:00 UTC
At 22:00 Taiwan time, PHP released four patched versions and disclosed the vulnerabilities. The UK's NCSC, CISA in the US, CERT-EU, Australia's ACSC, Singapore's CSA, and Japan's IPA issued alerts the same day.
2026-10-22
Taiwan's Administration for Cyber Security (Ministry of Digital Affairs) urged government agencies, schools, and businesses to confirm their versions and update promptly. It also issued notifications through its security alert system, N-ISAC, and TWCERT/CC.
THE SHIFT
The researchers who found the vulnerabilities described the change in their own words.
“Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
“Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours.”
“Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing.”
“To our knowledge, frontier AI found these vulnerabilities before attackers did. We expect similar findings to increase sharply in the coming months.”
“We observed how attackers were mutating the attack payload to try to bypass our protections.”
A professional audit found the same issue in 2024 but could not prove exploitation. In 2026, one researcher working with a model found several paths within days. Complexity no longer protects flaws that once seemed too difficult to exploit.
Wiz used models to adapt working exploits across applications in hours. Cloudflare saw attackers mutate payloads in real time. Defenders must write, validate, and deploy rules at the same pace.
Sansec estimated that widespread attacks would begin within 15 minutes of disclosure. Attacks had already started before the announcement. Quarterly penetration tests and monthly patch windows cannot handle this timeline.
Defenders found these flaws first. They may not find the next ones first. Vulnerabilities discovered at agent speed require defenses that move at agent speed.
ACT NOW
Follow this sequence, based on guidance from PHP, CISA in the US, the UK's NCSC, and Taiwan's Administration for Cyber Security (Ministry of Digital Affairs).
01
Look beyond websites. Include container images, CI environments, devices and admin panels with embedded PHP, and sites managed by hosting providers. Prioritize internet-facing systems. Compare your inventory with the affected products list maintained by NCSC-NL.
02
Install 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you use distribution packages, install your vendor's update. Restart Apache, PHP-FPM, and every long-running worker afterward. Otherwise, old processes will keep running.
03
PHP's mitigations are partial and may affect functionality. Adjust memory_limit and enforce memory limits with cgroup, lower post_max_size and max_input_nesting_level, disable session.upload_progress, set display_errors to 0, reduce PHP-FPM's pm.max_requests so workers recycle more often, and restrict worker permissions with SELinux or AppArmor.
04
Cloudflare automatically enabled rules for every plan. Customers on paid plans should confirm that blocking mode is active. A WAF provides partial protection and cannot replace the update.
05
Look for unusually large or malformed PHPSESSID cookies, unusual multipart requests followed by memory errors or repeated 500 responses, and unexplained worker crashes or restarts. An absence of these signs does not prove the system is safe. Check exposed, unpatched systems for backdoors before updating them.
06
The UK's NCSC and CISA in the US both advise considering taking systems offline when you cannot patch or mitigate them, especially if they still run 8.1 or older.
There are two ways to check. Both compare version numbers. Neither verifies the patch itself.
php -vAct if the reported version is below the applicable patched version listed above, or is 8.1 or older. If you use distribution packages, also confirm whether the vendor backported the patch.
git clone https://github.com/openai/php2shell-checker
cd php2shell-checker
node phpcheck.js "https://example.com"The tool only reads the PHP version from response headers. It does not follow redirects or inspect page content. It returns OK, VULNERABLE, or UNKNOWN.
TENTEN'S APPROACH · AI AGENT ACTIVE DEFENSE
Attackers already use frontier models to find vulnerabilities, write exploits, and mutate payloads. Annual penetration tests and manual patch schedules cannot keep pace. Tenten puts agents inside your environment to run a continuous cycle. A person makes every decision.
01 · INVENTORY
Continuously identify hosts, containers, devices, dependencies, and runtime versions, including hosted sites and devices with embedded PHP. Without an inventory, the next three steps rely on guesswork.
02 · DETECT
Use tools on par with the attacker's to research vulnerabilities across your stack. Monitor notices from PHP, distributions, CERTs, and vendors at the same time. The aim is to know where you are exposed before an advisory appears.
03 · VALIDATE
Reproduce the issue in an isolated sandbox, confirm whether it can be exploited, prioritize it by actual exposure, and prepare patch and mitigation plans. This keeps the team focused on vulnerabilities that attackers can reach.
04 · RESPOND
Deploy patches, update WAF rules, recycle workers, monitor signs of compromise, and retain evidence from every step. Only minutes may separate disclosure from attack, so this stage must be automated.
The PHP Foundation is explicit: AI helps validate and classify reports, but every decision is made by a human. Tenten applies the same rule. Your owner and our engineers decide whether to take a service offline, patch it, roll it back, or notify others. The agent assembles the evidence and carries out the approved action.
| Dimension | Annual penetration test | AI agent active defense |
|---|---|---|
| Cadence | Once or twice a year. The environment has changed by the time the report arrives. | Runs continuously. You know where exposure exists when an advisory appears. |
| Coverage | Samples systems within the agreed scope. | Uses a complete inventory, including containers, devices, and hosted sites. |
| Discovery to patch | Reporting, scheduling, and patching take weeks. | Validation, prioritization, and deployment take hours. |
| Response after disclosure | Waits for someone to start work and read their email. | An agent applies mitigation first, then a person decides the next action. |
| Where knowledge stays | A PDF report. | Your inventory, rules, and runbook stay ready for the next response. |
PRIMARY SOURCES
Each link was opened and checked. Entries include the publisher, date, and why the source is useful.
PHP Security Team · 2026-10-21
Official vulnerability description and patched versions
PHP Security Team · 2026-10-21
Official vulnerability description and patched versions
The PHP Foundation · 2026-10-21
The full release account, including the leak, embargo breach, and planned process changes
PHP · 2026-10-21
Download the four patched versions
NIST · 2026-10-21
CVSS scores and official references
NIST · 2026-10-21
CVSS scores and official references
Wiz Research · 2026-10-21
The research team's full account, models used, and disclosure timeline
Calif · 2026-10-21
The vulnerability's history from 2004 and how AI supported the audit
OpenAI · 2026-10-21
The Patch the Planet program, the Defender's Window concept, and OpenAI's outlook
OpenAI (GitHub) · 2026-10-21
An Apache-2.0 licensed tool that checks the PHP version by URL or locally
Research team · 2026-10-21
A reference page covering affected systems, mitigations, signs of compromise, and FAQs
Taiwan's Administration for Cyber Security (Ministry of Digital Affairs) · 2026-10-22
Taiwan's official guidance and notification channels
US CISA · 2026-10-21
Guidance to inventory, patch, or take unpatchable systems offline
UK NCSC · 2026-10-21
An eight-step response sequence, including compromise checks before updating
NCSC-NL · 2026-10-21
A continuously updated list of affected products and mitigation information
CERT-EU · 2026-10-21
Patched versions and guidance for unsupported branches
Australian ACSC · 2026-10-21
Critical alert and monitoring guidance
Singapore CSA · 2026-10-21
Official Asia-Pacific advisory
Japan IPA · 2026-10-21
Preparation guidance for asset inventory and vendor notifications
Cloudflare · 2026-10-21
Rule identifiers, automatic activation on free plans, and attacks observed before disclosure
Palo Alto Networks Unit 42 · 2026-10-21
Assessment from a threat intelligence perspective
Cisco Talos · 2026-10-21
Detection and protection guidance
Imperva · 2026-10-21
WAF rules and continuing updates
CrowdStrike · 2026-10-21
Detection from the endpoint perspective
Corelight · 2026-10-21
Detection methods at the network traffic layer
Akamai · 2026-10-21
Protection at the CDN and WAF layers
Help Net Security · 2026-10-21
A release-day report with statements from the teams involved
iThome · 2026-10-21
How the information leaked and warnings from security firms
TechNews · 2026-10-22
Government responses around the world
CyberQ · 2026-10-21
An enterprise response overview
Every link was verified on 2026-10-22. This page summarizes public information and is not an official advisory. Follow PHP's official guidance for versions and mitigations.
FAQ
Ask whether the provider has updated PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and when it restarted the service. Most providers show the PHP version in their control panel. If it is 8.1 or older, request an upgrade or change plans. Updating WordPress core and plugins does not fix this vulnerability.
No. The vulnerability is in the PHP runtime, not the application. The research team found that even Hello World is affected.
No. Cloudflare, Imperva, Akamai, and others have deployed rules, but attackers began mutating payloads before disclosure to bypass protections. PHP and CISA both say a WAF provides only partial protection and cannot replace the update.
All three branches are unsupported. The PHP Security Team published a minimal source backport for organizations that compile PHP themselves or lack an LTS vendor. If you use distribution packages, check whether your vendor backported the fix. CISA advises considering taking unpatchable systems on 8.1 or older offline and planning an upgrade.
The research team lists several signs: unusually large or malformed PHPSESSID cookies, unusual multipart requests followed by memory errors or repeated 500 responses, and unexplained worker crashes or restarts. An absence of these signs does not prove the system is safe. The UK's NCSC advises checking exposed systems for backdoors before updating them.
Attackers already use frontier models to find vulnerabilities in days, write exploits in hours, and launch attacks within minutes. Defenders need comparable tools for continuous inventory, detection, validation, and response instead of waiting for an annual penetration test. Tenten builds this cycle inside your environment, while people retain every decision.
This was a coordinated disclosure. Calif found the flaw with GPT-5.6 Sol through OpenAI's Patch the Planet program. OpenAI independently reported the same root cause. Wiz Research also found it independently using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. The PHP Security Team produced the patches and released them on 2026-10-21.
FREE CONSULTATION
You may not know how many PHP systems you have, whether your hosting provider has updated them, whether your WAF rules are enough, or how AI agent active defense would work in your environment. Share your contact details to arrange a free 30-minute online consultation.
START HERE
Indique su nombre y email de trabajo. El tipo de problema es opcional. Conoceremos el contexto por email; aquí no hace falta una especificación ni información confidencial.
El formulario aún se está cargando. También puede escribirnos directamente: inquiry@tenten.co
Your current information is enough for the consultation. You do not need to give us access to any system in advance.
Use the contact pageTenten AI compiled this page from public sources. It is not an official advisory and contains no exploit details. Follow official PHP guidance and your country's CERT for versions, mitigations, and response priorities. Contact us if you find an error or omission. Last updated 2026-10-22.