GoKawiilPHP Project issues mitigation steps for critical PHP2Shell vulnerabilities
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 in severity, affect most PHP builds and were patched by the PHP Project on Wednesday. Security firm Wiz, which found the flaws with AI assistance, says PHP runs on roughly 70% of websites worldwide, and the bugs allow memory disclosure and unauthenticated remote code execution independent of the application running on PHP.
GoKawiil's interpretation of the reporting above, not reported fact.
Because PHP underpins such a large share of the web, unpatched servers could be exploited quickly once attackers reverse-engineer the fixes, so security teams are urged to apply mitigations immediately rather than wait. Wiz's note that AI helped uncover the flaws also suggests, according to the firm, that AI tools could similarly speed up exploitation efforts by attackers, raising the stakes for rapid patching.
- Two critical PHP flaws (CVSS 9.2) affect most PHP builds and were patched Wednesday.
- PHP powers an estimated 70% of websites, making the bugs a widespread risk.
- Wiz warns AI could help attackers exploit the vulnerabilities just as it helped discover them.
Source: zdnet.com — Charlie Osborne, 2026-10-23
Published there as: “PHP2Shell: Haven’t patched yet? Take these steps now to mitigate”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.