Global – November 10, 2026 -- The PHP project shipped fixes on October 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0 and enabling unauthenticated remote code execution (RCE) over HTTP. Dubbed PHP2Shell, the flaws sit in the language itself, so every application built on PHP inherits the exposure.
Wiz says every PHP version back to 5.4 is affected
Wiz, one of the groups that reported the bugs, says PHP powers 70% of the world's websites. Against Apache with mod_php, the attack works before any application code runs.
EU governments pulled sites offline before patches were published
Reuters reported that an EU agency warned websites might need to go offline while PHP prepared its fixes. Many EU governments took affected sites offline, and attacks appeared before the patches were released. Details leaked ahead of the coordinated release, and Cloudflare has reported attackers reshaping payloads to evade its protections.
Three groups turned a stalled 2024 audit finding into an exploit
The bug behind CVE-2026-109618 surfaced as early signs in PHP's own 2024 security audit. No concrete exploitation path was found, and the fix stalled. This summer, three groups independently reached it: Calif, auditing PHP through OpenAI's Patch the Planet program, and OpenAI itself both reported it on August 11, and Wiz followed on August 24 with more attack paths.
Wiz says proving exploitability required a chain of steps at the edge of what human researchers could practically achieve, and that frontier AI models substantially lowered that barrier.
Vendor shipped RLC Pro LTS fixes 3.5 hours after upstream patch
The PHP project announced a critical release on October 20, disclosing only the severity. The vendor behind RLC Pro staffed up before disclosure. The upstream fix went public just before 14:00 UTC on Wednesday, and fixes for RLC Pro LTS 9.6 and 9.2 shipped about three and a half hours later. Fixes for other distributions are rolling out, and the vendor is working with the Rocky Linux community to cover Rocky Linux customers.
The author ties that speed to six months of handling AI-assisted kernel CVEs, including Copy Fail, Dirty Frag, Fragnesia and CIFSwitch in April and May. Those bugs required an attacker already on the system; PHP2Shell does not.
Google reports monthly CVE disclosures doubled this year
Google's threat intelligence team said last month that monthly CVE disclosures doubled this year. Half of the vulnerabilities it believes were found with AI lead to RCE, against about a quarter of the rest. The PHP Foundation said the number of reports "will keep growing."
The author expects the next targets to be other language runtimes and the libraries every distribution ships but few people read closely. In Enterprise Linux, fixes usually must be backported to versions upstream has stopped supporting. Bugs once parked as too hard to exploit are now candidates for AI-built exploit chains.