Two Critical PHP Bugs Let Attackers Take Over Web Servers Without a Password
Two critical flaws in PHP, the language that runs an estimated 70 percent of the web’s server-side code, let attackers remotely seize control of unpatched websites with no password and no victim action required. The PHP Foundation shipped fixes for both bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell,” on October 21, 2026, after confirming active exploitation.
Both CVE-2026-109618 and CVE-2026-109619 trace to how PHP’s internal engine uses a function called longjmp() to abort a request midway, according to a technical writeup by content delivery network Fastly. Certain code paths do not handle that abort correctly, leaving memory in a state an attacker can manipulate to execute their own code on the server, a technique known as remote code execution (RCE). Both vulnerabilities carry a CVSS v4.0 severity score of 9.2, on a scale that tops out at 10.
The PHP Foundation coordinated disclosure under embargo, giving major hosting providers and internet companies early access to patches before the public release. TechCrunch reported that the US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on October 21 urging immediate patching, and that the PHP Foundation later said one company pushed its patches live hours before the embargo lifted.
Who found the bugs, and how
According to TechCrunch, the underlying memory-handling issue was first noticed in 2024 but was not considered exploitable at the time and went unpatched. Security researchers at a firm called Calif rediscovered it during a PHP code audit earlier in 2026 and later found a working exploitation path, which they reported to the PHP Foundation. Security firm Wiz and OpenAI’s “Hack the Planet” initiative independently verified Calif’s proof-of-concept exploits before the public release.
How many sites were exposed
Fastly’s advisory says core PHP versions 5 through 8 were technically affected, though the PHP Foundation shipped backported fixes only for the actively supported branches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus source-level backports for the older 7.4, 8.0 and 8.1 branches. TechCrunch’s report put PHP’s overall share of web server-side code at roughly 70 percent, though that share has been declining for years as frameworks built on other languages have grown.
Amazon’s threat intelligence team told TechCrunch it had detected exploitation attempts beginning around October 17, four days before the public patch, meaning attackers had a head start on defenders. Security firms Palo Alto Networks’ Unit 42 and Trail of Bits confirmed they had seen compromises and follow-on attacker activity by the end of that week.
What happened after the patches went public
Exploit attempts rose sharply once the flaws were public knowledge, a pattern security researchers call “patch-diffing,” where attackers reverse-engineer a fix to build their own working exploit. Cloudflare chief executive Matthew Prince described an exponential rise in exploitation attempts against the company’s network in the days after disclosure, according to TechCrunch.
TechCrunch reported that banks, retailers, hospitals and some government agencies took servers offline as a precaution while they patched, and that millions of site operators worldwide had to scramble to apply the fix. Fastly has also published a temporary web application firewall rule for customers who cannot patch immediately, which it describes as interim protection rather than a substitute for updating PHP itself.
What it means for businesses running PHP
PHP underpins a large share of e-commerce platforms, content management systems and internal business tools, which is why TechCrunch reported that banks, retailers and hospitals opted to take servers offline rather than risk exploitation while patching. Because the flaw allows pre-authentication remote code execution, meaning no login is needed, a vulnerable server can be fully compromised before an administrator notices anything unusual in access logs.
Security teams typically recommend three steps after a disclosure like this: confirm the exact PHP version running in production, apply the vendor’s patched release or backport, and review server logs for the window between when exploitation began (around October 17, per Amazon’s findings) and when the patch was applied, to check whether an intrusion already occurred.
What happens next
Security researchers expect exploitation attempts to continue for weeks as slower-moving organizations work through patching unpatched servers, a pattern typical of widely deployed open-source software after a critical disclosure. The PHP Foundation has not said whether it will revise its embargo process after a vendor broke it ahead of schedule.
Frequently asked questions
Is my website affected? Any site running an unpatched PHP installation on versions 5 through 8 is potentially exposed. Site operators should confirm their PHP version has been updated to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or that their hosting provider has applied the vendor’s backported fix.
Do I need to change my password? The vulnerability does not target user account credentials directly, so there is no specific password-reset advisory tied to PHP2Shell itself. Site operators, not visitors, need to act by patching their servers.
Source: Fastly, TechCrunch.
Leave a Reply