On October 21, the PHP team shipped an emergency patch, CISA told organizations to patch immediately, and the BBC reported websites going down worldwide for emergency maintenance. By the next day, Palo Alto Networks' Unit 42 was already seeing attacks in the wild. The cause: two memory-safety vulnerabilities in the core PHP engine, CVE-2026-109618 and CVE-2026-109619, collectively named PHP2Shell. Severity up to CVSS 9.2. Every PHP version released in the last decade is affected, back to 5.4.

PHP runs roughly 70% of all websites - WordPress, Drupal, Joomla, MediaWiki. The flaws are not in any application. They are in the language runtime underneath all of them.

What the bugs actually do

The technical core, in plain terms. Both CVEs are memory-safety bugs in how PHP handles fatal errors while processing a request, particularly out-of-memory conditions. When a request dies the wrong way, it can leave corrupted internal state behind.…