By Thorsten Meyer | 21 October 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP has released emergency security updates for two critical vulnerabilities that can allow attackers to execute code remotely without logging in. For website operators, the immediate task is to update the PHP runtime and verify that the patched software is actually serving their websites.

The vulnerabilities, collectively known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security team identifies installations handling web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP security advisory

The disruption has already reached public services. The Dutch government said several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution on 21 October. That announcement described preventive action, not confirmed compromises of those services. Dutch government announcement

What the vulnerabilities do

Both flaws concern how PHP manages internal memory and state when request processing is interrupted.

Both advisories carry a CVSS v4.0 score of 9.2, Critical. PHP reports demonstrated exploitation on Apache with mod_php; the OOM advisory confirms execution as the web worker account, which does not automatically mean administrator or root access. OOM advisory · Stale-state advisory

Deployment details matter. Some demonstrated mod_php attacks occur before application code runs. PHP-FPM handles certain startup failures differently, but that does not establish immunity: Calif also describes application-dependent exploitation paths involving PHP-FPM. Calif technical research

For operators, this makes the runtime and its configuration central to assessing exposure.

The PHP versions containing the fixes

PHP released the following security updates on 21 October:

PHP 8.1 and earlier are outside normal upstream support. Because of the severity, PHP also provided minimal source backports for 7.4, 8.0 and 8.1. Organizations using distribution or extended-support packages should obtain their vendor’s fixed package or upgrade to a supported branch. An older-looking version number alone cannot establish whether a vendor backport is present. PHP release and upgrade guidance

Why Dutch services went offline

The Dutch government’s announcement said there were no signs of active exploitation at the time of that statement. It nevertheless identified enough risk to justify taking services offline before patches were available. It also clarified that many government websites, including Rijksoverheid.nl, did not use PHP and were unaffected by these particular flaws.

The Dutch National Cyber Security Centre subsequently confirmed that patches were available and urged organizations to update. Its published guidance says systems that have not been updated should remain offline as a precaution. Government statement · Dutch NCSC alert

Cloudflare, meanwhile, reports observing attack traffic and attempts to change payloads to bypass its protections. Those observations concern attempted exploitation; they do not establish that the named Dutch services were compromised. Cloudflare report

Readers should therefore distinguish the government’s initial assessment, preventive shutdowns, and a security provider’s observations of attacks.

Updating WordPress alone will not fix PHP2Shell

These vulnerabilities sit below the website application. Cloudflare explicitly warns that updating website code or plugins alone does not resolve them: the PHP software running the application must be patched. Cloudflare remediation guidance

Wiz demonstrated unauthenticated remote code execution against deployments of WordPress, Drupal and Joomla. It also demonstrated disclosure of sensitive process memory, potentially exposing credentials and tokens without achieving code execution. These demonstrations illustrate the impact of PHP engine flaws rather than separate vulnerabilities in each CMS. Wiz research

For publishers and businesses using managed hosting, the practical question is specific: has the provider patched the PHP runtime serving each affected website? A current WordPress dashboard is not an answer to that question.

AI helped find the flaws and develop working exploits

This disclosure also matters for the future of AI-assisted security.

OpenAI says Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the fixes and release, supported by researchers and infrastructure providers. OpenAI disclosure account

Wiz identifies Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol as tools used in its research. It describes AI helping with discovery, exploit development, detection and patch validation. Wiz research

Calif adds an important qualification: its initial discovery used generally available models, and the researcher directed the work using knowledge of PHP’s vulnerability history. Its account emphasizes asking informed questions and investigating related patterns. Calif research account

My reading is that this case demonstrates the value of capable models working inside an expert research process. The same ability to investigate failures and iterate on results can help defenders validate fixes and help attackers turn difficult bugs into practical attacks.

The human work behind the emergency release

The PHP Foundation’s account is unusually candid. It says signs of the underlying OOM problem emerged during work following a 2024 security audit. With no demonstrated exploitation path, difficult compatibility tradeoffs and too few deeply experienced developers, a fix stalled repeatedly. The Foundation describes the delay as a structural failure.

It also says disclosure was disrupted: CVE identifiers began circulating on 20 October, and the planned release moved forward from 22 October to 21 October. PHP Foundation account

This deserves attention alongside the AI discovery story. Finding a flaw faster does not automatically produce a safe patch, distribute it across hosting platforms or replace vulnerable processes. Those steps require experienced maintainers, operational coordination and sustained funding.

What website operators should do now

1. Inventory the PHP serving your websites. Include production, staging, older applications and separate hosting accounts. Establish the runtime used by each web service; a command-line PHP installation may be a different installation.
2. Apply the upstream fix or a confirmed vendor backport. For managed hosting, request confirmation that both CVEs are addressed in the package serving your sites. For containers, deploy the updated image rather than leaving old instances running.
3. Verify the running deployment. Confirm that the provider or administrator has completed the required service restart or redeployment and that web requests reach the patched runtime. Test essential site functions afterward.
4. Keep relevant WAF protections enabled. Cloudflare says it deployed protections for customers using its free and paid WAF offerings. Confirm that the appropriate rules cover your traffic; their presence does not replace the PHP update. Cloudflare protection details
5. Reduce exposure if patching must wait. Follow the official PHP guidance and your provider’s instructions. The Dutch NCSC stresses that temporary mitigations restrict specific attack paths and do not provide a complete fix. Consider restricting access or keeping an affected service offline until it is patched. Dutch NCSC guidance
6. Investigate suspicious activity separately. Wiz identifies unusual multipart requests, memory-limit failures, repeated HTTP 500 responses and unexplained PHP worker churn as investigative leads. These signals are not proof of compromise by themselves. Preserve evidence and involve incident responders if warranted; patching a vulnerability does not remove an intrusion that has already occurred. Wiz investigation guidance

General safeguards still matter. The UK’s NCSC recommends software updates, backups and two-step verification as part of everyday security. Those measures support resilience, but account protection does not repair a vulnerable server runtime. UK NCSC general security guidance

My assessment

PHP2Shell is an urgent infrastructure patching event with an important AI dimension. The immediate priority for a website owner is to establish whether the running PHP installation contains the fixes and to close any remaining exposure.

The broader lesson is that AI can accelerate the discovery and practical exploitation of weaknesses in software on which large parts of the web depend. Organizations need the ability to respond at the deployment layer, and the maintainers of that software need the resources to turn findings into reliable fixes.

For this incident, a successful response ends with patched software running in production and any suspected intrusion investigated.

This article covers the disclosures and guidance published on 21 October 2026. Operators should consult the linked advisories for subsequent changes.