Critical remote code execution flaws in the PHP runtime, designated CVE-2026-109618 and CVE-2026-109619, exposed the PHP ecosystem to immediate danger. These vulnerabilities, both rated 9.2 under CVSS v4.0, are located in the PHP runtime itself, meaning every PHP application inherits the risk, regardless of application-level authentication.
The potential severity was demonstrated by organizations worldwide. Upon disclosure, Germany forced federal sites offline, France shut down prefecture sites, and Belgium’s foreign ministry disabled its websites as precautions. Wiz, an independent security firm, estimates that PHP powers roughly 70% of the world’s websites, with every version back to 5.4 remaining affected.
Matthew Weier O’Phinney, a board member of the PHP Foundation, framed the PHP2Shell incident as an opening shot in a new era. He argued that while finding difficult bugs has become dramatically faster and cheaper, fixing and deploying patches still depends on scarce human expertise. This gap became the defining operational problem for the open-source supply chain.
The discovery methods also shifted the security paradigm. OpenAI disclosed that Calif, working through its “Patch the Planet” initiative, identified one of the flaws using GPT-5.6 Sol. Wiz independently identified both bugs and supplied additional attack paths. Wiz stated that proving exploitability required an exceptionally complex chain of steps, a barrier frontier models substantially reduced, turning a previously unpatchable-looking flaw into working remote code execution.
O’Phinney pointed out that the underlying issue was not new. The problem was surfaced in a 2024 PHP security audit, having stalled because no one could demonstrate a concrete exploit path. This summer, three separate groups achieved that demonstration within about two weeks of each other.
The disclosure process itself featured tension. CVE identifiers leaked on October 20, forcing the PHP project to accelerate its release to October 21. A deeper rift occurred when Chainguard released patched PHP container images six hours before the agreed embargo, citing the independent rediscovery of the flaw using a frontier model and the prompt, “find bad vulnerabilities in PHP.”
Despite the tensions, O’Phinney highlighted the technical response. He praised the collaborative efforts of the PHP Ecosystem Security Team, the PHP Foundation, and LTS vendors. They coordinated simultaneous patches across every supported branch and produced backports for end-of-life versions.
The vulnerability’s exploitation timeline reflected a race already lost. Amazon’s threat intelligence detected an exploit attempt on October 17, four days before patches were available. Cloudflare reported thousands of attempts in the ten hours before public disclosure, escalating to tens of thousands within forty-five minutes of the announcement.
These issues are not confined to PHP. O’Phinney noted that Node.js and Python reported similar critical vulnerabilities the same day PHP2Shell landed. Google’s threat intelligence team reportedly found that monthly CVE disclosures doubled this year, with half of believed AI-found vulnerabilities leading to remote code execution.
The most significant structural challenge involves end-of-life software. O’Phinney cited Zend’s estimate that around 40% of PHP users run unsupported versions. He warned that traditional advice to simply upgrade ignores the operational reality: moving a critical application requires changes to frameworks, libraries, extensions, and thorough testing.
Other experts sharpened the focus on maintenance capacity. Michelle Tilley of Atuin suggested that the coordinated response felt like a vendor emergency, a model that cannot be replicated for obscure libraries. Madelyn Olson of AWS and Valkey stated the difficulty has shifted from finding bugs to fixing them, requiring experienced maintainers.
The bottom line, according to O’Phinney, is that this is a new normal. OpenAI expects similar findings to sharply increase. PHP2Shell proved that AI can turn a decade-old, theoretically unpatchable-looking flaw into unauthenticated RCE across most of the web, and that attackers begin probing before defenders deploy a patch.
The resulting lesson for the ecosystem is that the vulnerability discovery capacity has risen dramatically, and the capacity to respond must keep pace. Organizations that fare best will be those that maintain visibility into their running software, stay on supported releases, and have a practiced process for validating, backporting, and shipping fixes under pressure. The patch race is now a permanent condition.
