PHP shipped emergency fixes on October 21 for two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and already nicknamed "php2shell" by researchers. The fixes — PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — cover every PHP installation that serves web requests: mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, according to WebProNews. mod_php is the most dangerous configuration, because the demonstrated exploit fires before any application code runs.
That's the advisory. Here's the story: the embargo leaked, and attackers got a four-day head start. Amazon's threat intelligence team reports that its MadPot honeypot network recorded a CVE-2026-109618 exploitation attempt on October 17 — four days before the embargo on the PHP advisories lifted — from an IP address on a commercial anonymization network. As Censys notes in its live advisory, Amazon says it is unclear how the attacker obtained exploit information while the vulnerability was still under embargo. Since the public release, Amazon reports "additional proof-of-concept activity" from multiple distinct sources and says CVE-2026-109618 "is now being broadly exploited in the wild."
There's a rich irony in who found these bugs. Cloudflare credited the disclosures to Calif.io, Wiz, OpenAI, and Quarkslab — the vulnerabilities surfaced through AI-assisted security research, with OpenAI's own models reportedly part of the discovery effort. The machines did the hunting; humans broke the chain of custody. Cloudflare said it watched attackers mutate payloads to get around its rules, and had WAF protections live for its customers nine hours before public disclosure. Sansec, which tracks attacks on Magento, Shopware, and WooCommerce stores, predicted it bluntly before release: "We expect mass attacks to start within 15 minutes of the release."
The exposure is enormous. Censys currently detects roughly 3.1 million hosts and 56.6 million web properties running PHP, and one Shodan count cited by Tenable put internet-exposed PHP hosts at over 1.9 million. If your host manages PHP, the fix has to come from the host — updating WordPress plugins or site code does nothing, because the flaws are in the runtime itself. Users of PHP 8.1 and earlier have it worse: no official builds, only source backports for 7.4, 8.0, and 8.1, and no fix path at all for 5.4 through 7.3.
CISA is strongly urging organizations to patch immediately, and VulnCheck warns that any internet-reachable host that was unpatched before the fix deserves a compromise check, not just an upgrade — its sensors caught an attempt to drop a webshell through a server-side session file. VulnCheck also holds a working, non-public weaponized exploit, while hundreds of copycat proof-of-concept repos have flooded GitHub, most of them unverified.
Watch what happens next on two fronts. First, the NVD still hasn't published entries for either CVE as of October 22 — the official paper trail is literally days behind the exploitation. Second, this is what AI-accelerated vulnerability discovery looks like in practice: the bugs were found faster, leaked faster, and are being exploited faster. Coordinated disclosure was designed for a world where finding a memory-corruption bug took months of expert labor. That world is over.
— via WebProNews