Two critical vulnerabilities in PHP, the programming language powering roughly 70% of the world's websites, triggered emergency patch releases on October 21, 2026. Each received a severity score of 9.2 out of 10. Collectively known as PHP2Shell, the flaws could enable attackers to expose sensitive information or execute malicious code on affected servers. The vulnerabilities concern website-hosting infrastructure rather than users' personal devices.
AI-assisted research helped uncover the defects: Calif identified one using OpenAI's GPT-5.6 Sol, while Wiz independently discovered both. The weaknesses involve PHP's handling of memory after errors, potentially leaving later requests with references to memory that has already been freed. Wiz discovered its first flaw on August 19 and reported the bugs to PHP's security team on August 24. Details leaked before the scheduled disclosure, intensifying the effort to deploy protections. Attempted attacks have since been detected, although researchers initially reported limited evidence of widespread exploitation.
Governments in France, Germany and Canada temporarily removed some websites from public access as a precaution. The Wikimedia Foundation also suspended supporting services while applying updates. Authorities urged operators to patch promptly or consider disconnecting affected systems until secured. Although security providers introduced protective filters, these do not eliminate the underlying vulnerabilities. Deployment also requires coordination across hosting providers, software distributors and website operators. Some vendors incorporate fixes into older packages without changing the displayed PHP version number, so operators should verify patch status with their providers rather than relying solely on a version check.
