PHP2Shell Flaws Exposed 70% of the Web to Passwordless Takeover
PHP2Shell flaws exposed 70% of the web to passwordless takeover. Patches are live, but confirmed attacks put systems at risk of data theft worldwide.
Summary
On Wednesday, October 21, 2026, the PHP Foundation patched PHP2Shell, CVE-2026-109618 and CVE-2026-109619, after Calif made two flaws first identified in 2024 remotely exploitable. The bugs permit passwordless remote code execution without user interaction, potentially giving attackers control of unpatched systems to steal data, install malware or retain access. Roughly 70% of the web uses PHP, including software underpinning WordPress, Drupal, Joomla, MediaWiki and Wikipedia. Millions rushed to update as governments issued warnings and banks, retailers, gaming sites, stores, hospitals, government agencies and Smartschool temporarily pulled services offline. Major internet companies and web hosts received patches early under embargo.
Calif found the exploitation route during a 2026 PHP security audit within Hack the Planet, an initiative from OpenAI and Wiz, which verified its proof of concept. AI assisted, but Calif said researcher expertise and familiarity with PHP provided most of the work. Amazon detected exploitation by October 17, about a week before public patches. The PHP Foundation said one company released fixes hours before the embargo expired, although that cannot explain Amazon’s earlier activity. By late Friday, Palo Alto Networks and Trail of Bits had confirmed compromise and malicious follow-on activity against an unidentified target. Cloudflare CEO Matthew Prince reported exponentially rising exploitation attempts, but no mass exploitation yet.
Exposure extends beyond websites to developer tools, routers, storage systems, firewalls and VPNs. Smaller teams, integrated products and unpatchable legacy systems may remain vulnerable for years. The NSA attributes about 75% of actively exploited vulnerabilities to memory flaws, accelerating movement from memory unsafe technologies such as PHP toward Python, Rust and Swift. AI could uncover more dormant weaknesses across aging internet infrastructure.
Positives
- October 21 patches from the PHP Foundation block web attacks when installed on affected systems.
- Early patch access helped major internet companies and web hosts reduce exposure before public disclosure.
- Industry coordination prevented signs of mass exploitation despite PHP supporting roughly 70% of the web.
- OpenAI and Wiz verified Calif’s proof of concept through the Hack the Planet initiative.
- Python, Rust and Swift offer memory safe alternatives immune to broad classes of memory vulnerabilities.
Risks & concerns
- CVE-2026-109618 and CVE-2026-109619 allow passwordless remote code execution without any victim interaction.
- Amazon detected exploitation from October 17, roughly a week before public patches became available.
- Palo Alto Networks and Trail of Bits confirmed compromise and malicious follow-on activity by late Friday.
- Cloudflare observed an exponential rise in exploitation attempts after disclosure.
- Routers, storage devices, firewalls, VPNs and unpatchable legacy systems could remain exposed for years.
- About 75% of actively exploited vulnerabilities abuse memory flaws, according to the NSA.