What is PHP2Shell?

• Websites globally, including those of Japan’s Finance Ministry, the Port of Rotterdam, and the Wikimedia Foundation, experienced precautionary shutdowns due to critical vulnerabilities in PHP.
• Two critical vulnerabilities, collectively named PHP2Shell, were discovered in PHP, a programming language powering approximately 70% of identifiable websites.
• These flaws could allow attackers to execute malicious code remotely on web servers without authentication or access sensitive information.
• Security updates addressing the vulnerabilities were released by PHP developers on October 21, 2026, following their discovery by security researchers using AI tools.

PHP2Shell.jpg

Detailed Insights:

• PHP, or Hypertext Preprocessor, is an open-source, server-side scripting language widely used for web development, including powering over 40% of global websites via WordPress.
• The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, both carry a critical CVSS v4.0 score of 9.2.
• CVE-2026-109618 involves memory corruption during out-of-memory conditions, while CVE-2026-109619 relates to stale global state persisting across requests.
• The vulnerabilities were discovered by researchers from Wiz, OpenAI, and CaliFI, with some utilizing AI tools for detection.
• Cybersecurity agencies advised immediate patching or temporary website shutdowns to prevent exploitation, as updating PHP can be complex, especially for older systems or shared hosting environments.
• The broad impact stems from the fact that these flaws reside in PHP‘s core runtime, meaning even secure application code on top of PHP could be vulnerable.

Key Concepts Involved:

• PHP (Hypertext Preprocessor): An open-source, server-side scripting language widely used for web development to process information and generate dynamic content.
• Remote Code Execution (RCE): A cybersecurity vulnerability allowing an attacker to run arbitrary malicious code on a target system or server from a remote location.
• Vulnerability: A weakness in a system or software that can be exploited by an attacker to compromise its security.