A pair of severe vulnerabilities in PHP, an open-source programming language that underpins approximately 70 percent of the public web, triggered a frantic international effort this week to patch millions of servers before malicious actors could compromise them, TechCrunch reported.
The flaws, known collectively as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, allow remote attackers to execute code and seize control of affected web servers without entering credentials or passwords. The PHP Foundation released emergency software updates on Wednesday after researchers discovered practical methods to exploit the weaknesses, which had sat dormant and unpatched in the codebase since at least 2024.
Global Scramble to Protect Networks
Governments, financial institutions, retailers, and healthcare facilities rushed to secure their networks starting Wednesday, with many operators temporarily pulling websites and services offline to apply the updates, according to TechCrunch. Widely used web platforms such as WordPress, Drupal, and MediaWiki rely on PHP, giving the flaw an expansive footprint across digital infrastructure.
The PHP Foundation had initially shared the fixes with major web hosts and tech platforms under a strict embargo to facilitate coordinated defenses. However, the organization stated that one participating firm deployed the patch early, inadvertently providing threat actors with a brief head start in analyzing the changes. Furthermore, Amazon noted in a corporate blog post that it detected malicious exploitation attempts as early as Oct. 17, nearly a week before the public rollout.
Once the details became public, automated scans surged rapidly. Network infrastructure company Cloudflare recorded millions of exploitation attempts within hours of the patch release, Chief Executive Matthew Prince disclosed. Despite the barrage, the PHP Foundation initially saw no evidence of broad compromise. By late Friday, however, cybersecurity providers Palo Alto Networks and Trail of Bits confirmed post-exploitation activity and system compromises on as-yet-unidentified targets, TechCrunch reported.
The Growing Role of Artificial Intelligence
Researchers at cybersecurity firm Calif uncovered the exploitation mechanism in August through the Hack the Planet initiative backed by OpenAI and cloud security firm Wiz, WIRED reported. Although Calif utilized frontier artificial intelligence tools to assist in creating the exploit, researchers stressed that deep human understanding of the PHP codebase remained essential.
“No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now,” Calif researcher Ryan Austin wrote in an analysis cited by WIRED.
Security analysts noted that while AI models are increasingly capable of finding ways to abuse aging code, they are magnifying established patterns rather than introducing unprecedented risks. Former National Security Agency hacker Jake Williams, now with Hunter Strategy, told WIRED that PHP presented a uniquely broad attack surface because it is exposed directly to the internet by design, meaning other legacy software may not yield such widespread risks.
Risks Persist for Legacy Systems
The incident has intensified concerns over the durability of foundational internet infrastructure maintained by volunteer developers. PHP is also classified as a memory-unsafe language, a category of software that the U.S. National Security Agency has warned accounts for roughly 75 percent of actively exploited security flaws.
While modern development often favors memory-safe alternatives such as Rust, Python, and Swift, older programming frameworks remain deeply embedded inside firewalls, routers, enterprise software, and home network devices. Analysts warned that although large corporations moved quickly to install Wednesday’s update, smaller businesses, municipal agencies, and unmanaged legacy servers may take months or years to patch, leaving an enduring vulnerability across the internet.
