PHP2Shell: Two Critical PHP Flaws Putting 75% of the Web at Risk
In October 2026, two critical remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—were publicly disclosed and rapidly weaponized. Discovered through AI-assisted vulnerability research, the flaws allow unauthenticated attackers to execute arbitrary code on unpatched web servers. With PHP powering an estimated 75% of all websites globally, the attack surface is enormous. Government agencies including CISA, CERT-EU, and the NCSC issued emergency advisories, while some organizations took servers offline as a precautionary measure. Active exploitation attempts were observed shortly after disclosure, underscoring the severity and urgency of the threat. PHP2Shell exemplifies the accelerating gap between vulnerability disclosure and mass exploitation. AI-assisted discovery is shortening the window defenders have to patch, while the sheer prevalence of PHP in web infrastructure means that even a moderate exploitation rate translates into thousands of compromised servers, amplifying supply-chain, ransomware, and data-exfiltration risks across every industry vertical.
Kill Chain
