On Wednesday, October 21, 2026, the PHP Foundation released emergency patches for two critical web bugs that researchers say could have let an attacker take over a huge share of the internet without a password. The flaws, known together as PHP2Shell, sit in PHP itself, the language behind around 70% of web-facing sites, including WordPress, Drupal, Joomla and MediaWiki. Banks, retailers and hospitals pulled services offline to update. The critical web bugs did not turn into the mass takeover many feared, but researchers warn the danger is not over.
This article explains what the critical web bugs are, which setups face the highest risk, which versions fix them, and what site owners should check first. It contains no exploit instructions, and it keeps the impact proportionate to documented sources. TechCrunch’s full account, read for this article, anchors the timeline, with patch details corroborated across specialist security coverage.
The critical web bugs are memory flaws in PHP that allow remote code execution without any login. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Systems on PHP 8.1 or older receive no routine upstream fix, so they need a vendor backport or an upgrade. Attempts surged after disclosure, but no mass exploitation has been confirmed.
In Brief
- Two critical web bugs in PHP, CVE-2026-109618 and CVE-2026-109619: PHP2Shell.
- Unauthenticated remote code execution: no password, no click needed.
- Both flaws scored 9.2 under CVSS version 4.0, a critical rating.
- Patches released October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Highest risk: Apache with mod_php; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed also at risk.
Why This Matters
PHP is old, free and everywhere, which is why the critical web bugs matter so much. The language has powered websites for decades, spreading into small blogs, giant retailers and the software inside routers, firewalls and VPNs. When a flaw sits in PHP itself, patching one site does not fix the problem, because every unpatched copy is a separate target. PHP is open-source software kept alive by a foundation and volunteers, yet large companies depend on it without paying for upkeep, and those maintainers often cannot afford third-party security reviews.
Speed is another reason to pay attention. Researchers at Calif found the bugs during a security audit under OpenAI and Wiz’s Hack the Planet initiative, which verified the proof-of-concept exploits. Calif says AI assisted with exploiting the bugs, but the bulk of the work rested on the researchers own knowledge of PHP.
The Two Critical Web Bugs
Both critical web bugs come from one problem: PHP can leave memory corrupted when a request ends abnormally, and later code can treat that broken state as valid. In CVE-2026-109618, out-of-memory corruption interrupts PHP while internal request data is only partly set up, and cleanup treats that broken data as valid. In CVE-2026-109619, stale global state outlives its freed memory, and a later request on the same worker can use it before it is reset. Either path can end in remote code execution.
Unauthenticated remote code execution removes every barrier an attacker would normally face: no login to guess, no link to click, no file to open. A successful attacker can plant malware or steal data. That is why the PHP security team rated both flaws 9.2 under CVSS version 4.0 and urged all PHP users to update immediately.
Who Is Actually at Risk
Every PHP installation serving web requests is in scope, according to the PHP security team, and risk varies by setup. Apache with mod_php carries the highest risk, because the PHP team demonstrated an exploit triggered by an unauthenticated request before any application code runs. PHP-FPM has at least one validated attack path, and php-cgi, FrankenPHP and LiteSpeed are also at risk. Exposure reaches beyond public websites, because PHP also appears in developer tools and components inside network and security devices.
Version matters as much as setup. Supported branches received fixed releases on October 21, but PHP 8.1 and older receive no routine upstream updates. The PHP team published minimal source backports for PHP 7.4, 8.0 and 8.1, but the durable fix is an upgrade or a vendor patch. Site owners who do not know their PHP version should ask their host, because the application on top does not change the answer: the flaw is in PHP itself.
Patch Now: Fixing the Critical Web Bugs
Updating is the only complete fix. Most administrators can stay on their current branch, move to the fixed release, then restart every PHP worker and rebuild any container images so old code stops serving requests. BleepingComputer’s account confirms the same fixed versions and warning for older branches.
Two follow-up checks close the gaps. First, check logs for exploitation as early as October 17, 2026, the earliest date Amazon flagged, because attacks began before the patches were public. Second, consider disabling session.upload_progress.enabled, a rarely used legacy feature that Aikido identifies as one confirmed path into CVE-2026-109619. On shared or managed hosting, the host usually applies the update, but on an unmanaged server the owner must act and confirm the running version afterwards.
Confirmed, Reported, Unknown
Confirmed: patches released October 21, 2026; the two CVE identifiers; unauthenticated remote code execution; fixed versions for branches 8.2 through 8.5; highest risk for Apache mod_php; and a surge of attempts after disclosure, with Cloudflare reporting thousands before announcement, tens of thousands within 45 minutes after it, and millions since, according to its chief executive.
Reported but not fully settled: details leaked on October 20, ahead of planned disclosure, and the PHP Foundation blamed one company for pushing patches live hours before the embargo ended, though that does not explain the earlier activity Amazon detected. Working exploits existed by late Friday, according to Trail of Bits. Still unknown: how attackers first learned of the flaws, how many attacks succeeded, how many systems remain unpatched, and whether mass exploitation will follow. One vendor finding about post-exploitation activity was retracted.
What Happens Next
The critical web bugs will fade from headlines before they fade from servers. Large companies patched under embargo, but smaller teams patch more slowly. Legacy systems with no update path may stay exposed for years.
The longer lesson concerns memory-unsafe languages. PHP, like other decades-old technologies, can be attacked through memory flaws, and the US National Security Agency says around 75% of actively exploited vulnerabilities abuse memory-related flaws. That pressure is pushing new work toward memory-safe languages such as Python, Rust and Swift. TechCrunch frames this incident as possibly the first of a trend in which AI-assisted discovery finds flaws in legacy technology faster than teams can fix them.
Quick Answers
Am I affected if my site runs WordPress? Yes, if the server underneath runs an unpatched PHP, because the critical web bugs are in PHP itself, not in WordPress.
Which versions fix the critical web bugs? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have no routine upstream fix, so check your vendor for a backport.
Did the internet break? No mass exploitation has been confirmed and no evidence shows a mass takeover. Many sites went offline to patch, and risk now sits with systems that stay unpatched.
Was AI used to find the flaws? AI assisted with exploiting them, according to Calif, but the researchers say the bulk of the work came from their own knowledge of PHP. The audit ran under OpenAI and Wiz’s Hack the Planet initiative.
Final Word
The PHP-ocalypse did not break the internet, and that is the good news. The warning is that it easily could have: two critical web bugs in one of the web’s oldest languages, open to anyone without a password, with patches racing a leak and attackers already active. The difference between a scare and a catastrophe was coordinated patching before disclosure.
For anyone running a website, the action is simple: confirm the PHP version, move to a fixed release or a vendor backport, restart the workers, and check logs back to October 17. For everyone else, the lesson is less comfortable: the internet still runs on code written decades ago, maintained by few, and AI is now helping both sides find cracks.
Sources / Attribution
- TechCrunch, “PHP-ocalypse: How two critical web bugs almost broke the internet,” October 24, 2026 (read in full).
- BleepingComputer, “PHP ships emergency patches for critical PHP2Shell flaws” (fixed versions, affected setups).
- SOCRadar, PHP2Shell timeline (October 17 first attempts, October 20 leak, October 21 patches).
- Aikido, PHP2Shell fix guide (CVSS 9.2 rating, session.upload_progress.enabled mitigation).
- TuxCare, PHP2Shell patch guide (the leaked 10.0 figure was never PHP’s rating).
- Amazon, Cloudflare and Trail of Bits, as cited by TechCrunch.
