putilov_denis - stock.adobe.com
PHP2Shell: 22M exposed servers at risk as emergency patches released
AI gave defenders a head start, but PHP2Shell has sparked a chaotic race against automated exploits across 22 million vulnerable servers.
The PHP Foundation has released emergency patches for two critical vulnerabilities in PHP, the open source scripting language that underpins an estimated 70% of the web.
Palo Alto Networks said Wednesday it had identified more than 22.6 million exposed instances potentially vulnerable to the PHP2Shell flaws.
The vulnerabilities were uncovered by GPT-5.6 Sol, which OpenAI said helped researchers detect the underlying memory-handling flaws.
"Over the past two months, we led a coalition of maintainers, researchers and security providers to prepare fixes and protections ahead of disclosure," OpenAI said. "This duration was necessary because the fix was quite intricate and required a major change to the PHP engine."
OpenAI added, "Due to the severity of these flaws and PHP's widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory."
In a post on X, Austrian programmer and OpenClaw creator Peter Steinberger said the vulnerability would "cause havoc" this week, as enterprises and site owners scramble to make the necessary patches.
The bugs in detail
CVE-2026-109618 and CVE-2026-109619 are both critical remote code execution (RCE) vulnerabilities with a CVSS rating of 9.2.
CVE-2026-109618 involves a flaw where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory triggers.
CVE-2026-109619 describes a vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.
According to the PHP Foundation, all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
"We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," the PHP Foundation said.
Urgent warnings
In the immediate hours after the vulnerabilities were disclosed, Wiz researchers said the flaws in the core PHP engine were akin to Heartbleed-style memory disclosure across the web.
"Nearly every PHP version is affected by at least one of these issues, including releases dating back to PHP 5.4," Wiz said.
Web infrastructure firm Cloudflare said it had already deployed protections against the PHP2Shell vulnerability, but noted that protecting against the flaws requires more than standard request-based rules.
"Request data alone does not always provide enough evidence to distinguish an exploit from legitimate traffic," the company stated.
Forrester senior analyst Madelein van der Hout warned that checking surface-level systems won't suffice.
"What makes these vulnerabilities significant is where they sit. PHP underpins websites and applications across many organizations and their suppliers, so checking the corporate website alone is not enough," van der Hout said. "Organizations need to establish where they are exposed and prioritize internet-facing systems."
She added, "Speed matters, but patching is only part of the response. Security teams need to identify where PHP is running, prioritize exposed systems, apply the official fixes promptly and investigate signs of compromise. A patch fixes the vulnerability; it does not necessarily remove access an attacker may already have established."
Justin Timothy, principal threat intelligence consultant at GuidePoint Security Research and Intelligence Team (GRIT), stressed that hunting for early indicators is critical.
"No vendor-published or confirmed indicators of compromise exist for these vulnerabilities, so detection currently depends on behavioral hunting, and a clean result does not rule out compromise," he said.
Mitigation and guidance summary
Organizations -- including those following alerts from national cybersecurity bodies such as the UK's NCSC -- are urged to take immediate action.
Key priority actions for administrators include:
- Map your exposure. Take stock of all internal and public-facing systems running PHP across your stack. Do not limit checks to legacy installations -- all versions are affected.
- Apply patches. Upgrade to patched versions immediately. For Linux LTS distribution users, check distribution package managers for backported fixes.
- Handle legacy versions (PHP 8.1 & older). Upstream support for PHP 8.1 and below has ended. Apply minimal source backports provided by the PHP team or coordinate with LTS vendors to upgrade.
- Deploy temporary mitigations or disconnect. If full patching cannot be applied immediately, implement temporary web server mitigations or take high-risk internet-facing systems offline until they are secured.
- Inspect for pre-patch compromise. Preserve all server logs from Oct. 20 onward before restarting or rebuilding servers. Audit systems for backdoors or unusual activity before applying updates.
As site owners and enterprise teams race to apply emergency fixes, OpenAI said the finding highlights another milestone in automated vulnerability discovery.
"This is an example of the defender's window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare," the lab said.
James Walker is lead editor at TechTarget Cybersecurity News.
