{"id":19,"date":"2026-10-23T13:22:27","date_gmt":"2026-10-23T13:22:27","guid":{"rendered":"https:\/\/cyberscop.com\/blog\/?p=19"},"modified":"2026-10-23T13:29:02","modified_gmt":"2026-10-23T13:29:02","slug":"php2shell-php-vulnerability-explained","status":"publish","type":"post","link":"https:\/\/cyberscop.com\/blog\/php2shell-php-vulnerability-explained\/","title":{"rendered":"PHP2Shell Explained: The PHP Bug AI Found, and What It Means for You"},"content":{"rendered":"

PHP2Shell is the name for two serious security bugs in PHP, the programming language behind most of the websites you use every day.<\/strong> The bugs let an attacker take control of a website’s server without needing a password. They sat unnoticed in PHP for more than 10 years, and they were only found in 2026 because security researchers used AI to dig through the code. Fixes came out on October 21, 2026. If you run a website, update PHP now. If you just use websites, you don’t need to panic, but stay alert for scam emails.<\/p>\n

Below, we explain everything in simple words: what happened, how the bug works, why governments switched their websites off, and exactly what you should do.<\/p>\n

PHP2Shell at a glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n
Question<\/th>\nShort answer<\/th>\n<\/tr>\n<\/thead>\n
What is it?<\/td>\nTwo critical security bugs in PHP<\/td>\n<\/tr>\n
Official IDs<\/td>\nCVE-2026-109618 and CVE-2026-109619<\/td>\n<\/tr>\n
How serious?<\/td>\n9.2 out of 10, rated “critical”<\/td>\n<\/tr>\n
Who is affected?<\/td>\nSites running PHP 5.4 or newer that haven’t been updated<\/td>\n<\/tr>\n
Safe versions<\/td>\nPHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12<\/td>\n<\/tr>\n
Who found it?<\/td>\nSecurity researchers at Wiz and Calif, using advanced AI models including OpenAI’s<\/td>\n<\/tr>\n
Is it being attacked?<\/td>\nYes, attackers are trying it on a huge scale<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

What is PHP2Shell, in simple words?<\/h2>\n

Think of a website as a restaurant. You only see the dining room: the menu, the tables, the food that arrives. PHP is the kitchen at the back. It takes your order, gets things from the storeroom (the database) and puts your page together before it reaches your screen.<\/p>\n

PHP2Shell is a fault in how that kitchen is built. Because the fault is in PHP itself, not in one particular website, it affects every site using an unpatched version, from a small blog to a government portal. An attacker who knows the trick can walk into the kitchen without being invited and start giving orders. In computer terms, that means running their own code on the server.<\/p>\n

The “Shell” part of the name comes from hacker slang. Getting a “shell” on a server means you can type commands on it as if you were sitting in front of it.<\/p>\n

What is PHP, and why does this bug affect so many websites?<\/h2>\n

PHP is a programming language that runs on web servers. It started in the 1990s as “Personal Home Page” and today officially stands for “PHP: Hypertext Preprocessor”. Online shops, blogs, news sites and government portals all use it, and so do popular platforms such as WordPress, Drupal, Joomla and Magento.<\/p>\n

That’s why you’ll see the “70%” figure in the news. PHP runs on roughly 70% of websites whose server-side language is known<\/a>. So a bug in PHP isn’t a problem for one company. It’s a problem for a big part of the web at the same time.<\/p>\n

How does the PHP2Shell bug work?<\/h2>\n

You don’t need to be a programmer to understand the basic idea.<\/p>\n

    \n
  1. PHP sometimes hits a serious error<\/strong>, such as running out of memory. It’s supposed to stop safely when that happens.<\/li>\n
  2. The bug is in that “stop safely” part.<\/strong> An attacker can send specially crafted requests that push PHP into these errors on purpose.<\/li>\n
  3. At first, that only crashes things.<\/strong> The hard part, which took years to work out, was turning a crash into a way to run the attacker’s own commands.<\/li>\n
  4. Once that works, the attacker is in.<\/strong> They can change the website, install malware, steal data from the database or take the site offline. Researchers at Wiz also found that attackers could read passwords and other secret keys straight from the server’s memory.<\/li>\n<\/ol>\n

    The worst part is that the attacker doesn’t need an account or a password. They only need to reach the website over the internet, like any normal visitor.<\/p>\n

    How did AI find a bug that people missed for over 10 years?<\/h2>\n

    The bugs were always there. What was missing was someone patient enough to prove they could be used in a real attack. Wiz said that showing this took “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve”<\/a>.<\/p>\n

    That’s exactly the kind of long, boring, step-by-step work AI models are good at. They don’t get tired, and they can try thousands of small variations quickly. Security researchers at Calif, working with OpenAI, reported the first bug to PHP’s developers on August 11, 2026. Researchers at Wiz, a cybersecurity company owned by Google, reported the second on August 24.<\/p>\n

    OpenAI said that “to our knowledge, frontier AI found these vulnerabilities before attackers did”<\/a>. In other words, the good guys got there first, and PHP’s developers had about two months to build a fix before the news went public.<\/p>\n

    What happened, day by day?<\/h2>\n\n\n\n\n\n\n\n\n\n\n
    Date (2026)<\/th>\nWhat happened<\/th>\n<\/tr>\n<\/thead>\n
    August 11<\/td>\nCalif, working with OpenAI, reports the first bug to PHP’s developers.<\/td>\n<\/tr>\n
    August 24<\/td>\nWiz reports the second bug.<\/td>\n<\/tr>\n
    October 17<\/td>\nAmazon’s security team spots someone trying to use the bugs against its trap servers, four days before the public announcement.<\/td>\n<\/tr>\n
    October 20<\/td>\nDetails of the bugs leak online before the fixes are ready.<\/td>\n<\/tr>\n
    October 21<\/td>\nPHP’s developers release the security updates and tell everyone to install them immediately.<\/td>\n<\/tr>\n
    October 21 to 23<\/td>\nGovernments and companies take websites offline to patch them, and attack attempts climb into the millions.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Is PHP2Shell being exploited right now?<\/h2>\n

    Attackers are definitely trying. Matthew Prince, the head of Cloudflare, said his company saw tens of thousands of attempts in the first 45 minutes<\/a>, and that the number had grown into the millions within two days.<\/p>\n

    Someone even had a head start. Amazon detected an exploit attempt on October 17<\/a>, against a network of decoy servers it uses to catch attackers. That was four days before the bugs were made public, and nobody yet knows how that attacker found out early. Amazon said there’s no evidence of a leak from its own systems.<\/p>\n

    Some people in the security world have started calling this wave “Black October”. The good news is that, so far, there are no confirmed reports of massive real-world damage. Many organizations patched quickly, and many others took their sites offline until they could.<\/p>\n

    Why did governments take their websites offline?<\/h2>\n

    When a bug this serious goes public, it becomes a race. Attackers try to break in before website owners can install the fix. If you can’t patch in time, the safest move is to switch the site off for a few hours. The FBI encouraged organizations to do exactly that<\/a> if they couldn’t update straight away.<\/p>\n

    Plenty of well-known organizations did. According to Al Jazeera<\/a>:<\/p>\n