Two severe vulnerabilities, dubbed PHP2Shell, that affect every version of PHP since version 5.4 were improperly disclosed this week, leading to a panic as the PHP project raced to release updated versions of the server-side scripting language that patched the two remote code execution (RCE) vulnerabilities.
As explained by The PHP Foundation, cybersecurity firm Calif began an audit of PHP on July 30, 2026. On August 11, 2026, a researcher at Calif reported an unconditional RCE that harked back to a potential exploit for an out-of-memory (OOM) problem discovered in 2024. OpenAI then reported the same problem on the same day. Both OpenAI and security researchers at cloud and cybersecurity firm Wiz reported attack vectors.
“The reports from Calif, OpenAI, and Wiz made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation’s team working on security. Without the Foundation’s funding it would have been impossible to have multiple people work on this issue full time, eventually through weekends and around the clock to coordinate and communicate with other involved parties,” wrote The PHP Foundation.
Wiz demonstrated the exploit worked against WordPress, Drupal, and Joomla, and reported that the problem could affect as much as 70 percent of the internet.
On Tuesday, October 20,2026, CVE IDs for the vulnerabilities began circulating online. Unfortunately the information being shared included an incorrect patch release time and a CVSS score of 10.0, while the actual severity score was 9.2. Following this irregular exposure, Calif mistakenly published a video showing a proof of concept exploit.
In response, The PHP Foundation, which was preparing the patch, moved the release date up from October 22, 2026, to October 21, 2026. The patch is currently available and website operators using PHP are advised to update to the latest version as soon as possible.
Wiz highlighted that it leaned on AI to assist in understanding the vulnerabilities and how they could be exploited.
“The vulnerable code had been there for more than a decade – what AI changed was the ability to understand the weaknesses and turn them into a working exploit. With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” the company wrote in a blog post.
“When vulnerabilities are leaked before a patch is available, it is usually a scramble to do whatever is possible to mitigate the damage, but the sheer scale of PHP across the internet makes this far more serious than the usual exploit. A serious vulnerability in technology used by millions of websites could immediately give cybercriminals an enormous number of potential targets,” Jake Moore, ESET Global Security Advisor, told w.media.
“A situation like this gives attackers a huge head start. Criminals are known to be extremely quick to exploit any given opportunity, and even a short delay in patching could leave lots of businesses exposed,” added Moore.
As reported by Reuters, several government, school, and hospital websites across Europe were taken offline on Wednesday as a means to protect themselves from the vulnerability. These included the BBC, the National Cyber Security Center in the Netherlands, and the French Interior Ministry among others.