PHP discloses critical PHP2Shell vulnerabilities as attacks emerge
PHP maintainers disclosed two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell. The flaws can allow attackers to run unauthorized software and potentially take control of unpatched PHP web servers. Emergency patches were released; Cloudflare reported observing early attacks, and some government and commercial operators took websites offline while patching.
The candidate identifies a new, concrete and forward-looking cybersecurity development: PHP maintainers disclosed two critical remote-code-execution vulnerabilities, emergency patches were released, some operators took websites offline, and Cloudflare reported observing early attacks. The development has broad potential operational and security consequences because PHP is widely used, although the provided context does not establish widespread successful compromise; reported activity is limited to attempted or early attacks. The date is explicitly identified as Wednesday, October 21, 2026, but no precise occurrence time is provided, so midnight UTC is used as a date-level estimate. This is not a duplicate of the prior Google Cloud remediation update; it is a distinct disclosure and emerging-exploitation milestone within existing event 9505. GoDaddy and Cloudflare are approved because the context provides a direct operational exposure or event-specific defensive response; more speculative cybersecurity vendors are excluded.
The creators of PHP, a technology that powers as much as 70% of the world's websites, disclosed a critical security issue Wednesday that could be leveraged by hackers to take control of any system running its software.
Some government and commercial site operators say they pre-emptively took their sites offline, and reports of attempted cyberattacks began circulating on Wednesday.
The discovery of two serious flaws in PHP this week set off a global scramble to keep websites safe from hackers, showing just how critical the three-decade-old open-source programming language is to the internet.
The foundation works with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes, including Wednesday's patches.