The PHP project has shipped patches for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. No confirmed attacks have been reported yet, but researchers say probing has already begun.
Key takeaways
- Both flaws are rated 9.2 out of 10 and could allow an attacker to run code on a vulnerable server.
- CISA and several security firms say they have not seen confirmed exploitation, but scanning activity is under way.
- CERT-EU says every PHP version from 5 onward may be affected, though the PHP team has not officially confirmed the full list.
- Most internet-facing PHP servers that reveal their version run branches that no longer receive security updates.
PHP maintainers released emergency patches on Wednesday for two critical vulnerabilities in the scripting language that powers a very large share of the web. The release came a day earlier than planned.
What has been disclosed?
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a 9.2 rating on the CVSS v4.0 severity scale, which tops out at 10. Researchers describe them as remote code execution bugs, meaning an attacker could run their own code on a server and potentially take control of it. Researchers have nicknamed the pair “php2shell.”
Some important details remain unconfirmed. The PHP team has not officially stated the technical cause or published a complete list of affected versions, saying full details would accompany the release. An advisory from CERT-EU, the European Union’s computer emergency response team, says the flaws could affect every PHP version from 5 onward.
Why the release came early?
According to security firm watchTowr, the fixes had been scheduled for Thursday under an embargo. The PHP team brought the release forward by a day and said it could move even sooner if technical details leaked or exploitation began.
That caution proved justified. A video showing an exploit chain began circulating online overnight, shared by researcher Kirill Firsov, who credited researchers known as LCFR and Calif.io. watchTowr said it had reproduced one of the flaws. Code claiming to exploit the bugs is also in circulation, but it has not been verified, and security firms warn that such code is sometimes bundled with malware.
Is anyone being attacked yet?
So far, the evidence points to preparation rather than widespread attacks. In its release, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said it had not observed exploitation at the time of publication, while stressing that unpatched systems remain at risk.
Researchers who spoke to CyberScoop described mostly reconnaissance, with scanners checking which vulnerable systems are still reachable online.
- Kelly Shortridge, chief product officer at Fastly, said attackers are clearly probing PHP applications. She noted that for flaws of this severity, the gap between disclosure and repeatable, widespread exploitation is typically hours to a few days.
- Jon Semon, principal security operations analyst at Huntress, said his team has not observed or independently confirmed successful exploitation on live customer systems. Huntress checked the Linux web servers it can see for behaviour matching the public proof of concept, such as a web server process launching a shell to run reconnaissance commands or writing a file into the web root, and found nothing.
How big is the exposure?
The potential footprint is large. Market research cited in the reporting puts PHP at roughly 70 to 80 percent of websites whose server-side language is known. It underpins widely used platforms including WordPress, Drupal, Joomla and Laravel.
Estimates of vulnerable systems vary. Researchers put the number of internet-exposed hosts that could be affected at more than 1.3 million, while a Shodan search counted about 1.9 million.
The patching picture is difficult as well. VirusTotal data shows that among servers disclosing their version, about 758,000 run versions from 5.4 through 8.1. Only about 272,000 run branches that still receive security updates. In practice, a large number of servers may not have an official fix available through normal channels.
There is also a precedent. CISA’s Known Exploited Vulnerabilities catalog already lists three PHP flaws, two of which were used in ransomware campaigns.
How the flaws were found?
The vulnerabilities were discovered by the AI security firm Calif, using OpenAI’s cybersecurity-focused model GPT-5.6 Sol. Wiz, the security company Google acquired in March, independently found and reported the same issue, according to a blog post OpenAI published Wednesday.
OpenAI said the discovery led to a two-month collaboration among the company, PHP maintainers, researchers and security vendors to build a lasting fix and prepare for disclosure. The company described this as a “Defender’s Window,” saying that, to its knowledge, frontier AI found the bugs before attackers did. It added that it has found several other significant vulnerabilities and expects such findings to rise sharply in the coming months.
Wiz published its own account, saying it found multiple critical memory-safety vulnerabilities in PHP using GPT-5.6 Sol, its own Wiz Atlas tool and Google’s Gemini 4 Argon.
Why this matters beyond PHP?
According to Wiz, the underlying weakness is reported to have existed for decades. It stayed relatively safe in practice because exploiting such memory bugs is slow and technically demanding. An attacker would need to build an exploit that works across different PHP versions, configurations and application behaviours, then test and debug every variation.
Wiz researchers argue that AI changes this. Language models can adapt exploits to different versions and memory layouts and use debugging tools, which lowers the specialist effort needed per target. In the researchers’ words, the barrier is “no longer a barrier,” and the economics of both finding and exploiting bugs are shifting.
What administrators should do now?
- Apply the new PHP patches as soon as they are available for your branch. OpenAI also said patching is the priority and offered a free tool to help identify vulnerable versions.
- Check which PHP version your servers run. If you are on a branch that no longer receives security updates, plan an upgrade to a supported version.
- Isolate internet-facing applications where immediate patching is not possible. This is the guidance from CERT-EU and Britain’s National Cyber Security Centre, which also advised organisations to prepare for rapid updates.
- Treat public exploit code with caution. Unverified proof-of-concept code may carry malware.
- Watch for further advisories. The PHP team was to publish its full advisory with the release, and Huntress and Tenable said they would update their analyses as technical details emerge.
Frequently asked questions
What are the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619?
- They are two critical remote code execution flaws in PHP, each rated 9.2 on the CVSS v4.0 scale. Researchers nicknamed them “php2shell.”
Are the PHP vulnerabilities being exploited?
- As of Wednesday afternoon, CISA and security firms such as Huntress said they had not confirmed successful exploitation. Researchers did report active reconnaissance against PHP applications.
Which PHP versions are affected?
- The PHP team has not published a complete official list. CERT-EU says every version from PHP 5 onward could be affected.
Does this affect WordPress sites?
- WordPress runs on PHP, so sites on a vulnerable PHP version could be exposed. The fix is to update the PHP version on the server, not only the WordPress software.
