What is the PHP Vulnerability?

Introduction

On October 21, 2026, alarm bells sounded after a critical vulnerability was found in the PHP script language which involved bad actors being able to execute attacks on any server that ran on PHP. About 70% of the Internet still runs on PHP, so it cannot be overstated how many websites are affected by this.

Websites across the Internet had to be taken down in order to rectify the situation and apply the security patch. This vulnerability has been called “php2shell”, which allows bad actors to execute remote code in PHP and affect all PHP installations serving web requests. This means that anything running PHP can be remotely accessed if attacked in this manner.

What is PHP?

PHP, which is a recursive acronym for PHP: Hypertext Reprocessor, is a free, open-source server scripting language for web development. It was originally invented in 1995 and is still used by 70% of the Internet today. It is highly likely that some websites you use are still running PHP.

Web servers typically run on PHP, which can be any type of data like HTML or binary image data. However, it can extend past websites and be used for programming outside of websites, but it is less likely the case. PHP includes many libraries, including PostgreSQL, MySQL, Microsoft SQL Server, SQLite, LDAP servers, and more.

The Vulnerability

When it comes to vulnerabilities, NIST supplies a rating of how serious it may be. They use the Common Vulnerability Scoring System (CVSS) in a range from 0.0 (no threat) to 10.0 (critical threat). Usually, these vulnerabilities are in the low to medium categories, but this specific one has been ranked a 9.2 by the NIST.

The vulnerability, known as “php2shell”, is actually two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. They allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. In order to supply the security patch for this, many websites had to be taken down for hours.

According to CVE.org, these vulnerability involve various global states that temporarily point into request memory. In some cases, this state is not reset correctly, or may be repopulated after being reset. It refers to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple attacks can trigger this condition and produce remote code execution (RCE).

The Security Patch

According to NIST at the time of discovery, php2shell had not been acted on, although there have been signs of early exploitation. The security patch that was made available by PHP remediates the vulnerability. PHP has advised to immediately patch databases as soon as possible by upgrading to 8.5.12, 8.4.26, 8.3.36, or 8.2.35, as the vulnerability affects every version prior.

If the updates cannot be immediately applied, there are various commands that can be run, like setting memory limits or removing invalid or deprecated settings. However, updating is the only complete solution that can be done. It is a good idea to take your website or application offline until the update is applied. Depending on the size of the website, it may take longer to update than others.

OpenAI’s Disclosure

The vulnerability was first discovered by OpenAI, using GPT-5.6 Sol as part of their Patch the Planet initiative, which is a program that they are using to find and fix critical flaws in software. After discovering it with Wiz and Cloudflare, OpenAI relayed the information to PHP, who quickly developed and distributed the security patch update.

Conclusion

A new PHP vulnerability was discovered by OpenAI under their Patch the Planet program. Using GPT-5.6 Sol, an LLM that checks for flaws and security issues in software, the company was able to find a critical vulnerability in PHP that had been previously unknown. The company contacted PHP and made sure that they were aware of it, since 70% of the Internet still uses PHP-based websites and web servers. PHP was quick to push out a security patch update.

However, due to it being a web server incident, many websites were pulled offline in order to update. Some websites took hours to come back up, but it was an important update to do. Patching is an immediate fix, but if there is a reason you can’t update, there are ways to protect your web server to lower the chances of an attack. If you aren’t sure that your web server has been patched, be sure to talk to your IT professional. Alternatively, a vCISO can also help with patching your PHP web server.