Two critical PHP flaws, jointly called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), let an attacker run code on a server without a password. Patches shipped on October 21, but the post-mortem shows attacks began earlier.
What is known
The security firm Calif found the bugs. They were first judged unexploitable, then the researchers worked out an attack and told the PHP Foundation. The Foundation ran a confidential embargo so large companies and hosts could patch early. WordPress, Drupal, Joomla and MediaWiki, which powers Wikipedia, were all in the blast radius. The article estimates that around 70% of web-facing sites rely on PHP.
Where it went wrong
Amazon spotted exploitation attempts about a week before the patches were public and advised defenders to look for traces from October 17. Theories include a leak during the embargo, independent discovery of the same bug, or espionage. The Foundation blames one company for publishing fixes hours before the embargo ended. By late Friday, Palo Alto Networks and Trail of Bits had confirmed compromises, and Cloudflare reported a sharp rise in exploit attempts after disclosure.
The AI angle
Calif says AI helped with exploitation, but the researchers' own expertise did most of the work. In their words, no model can find every bug with a simple prompt, at least for now.
What to do
Banks, shops and hospitals took servers offline to update. Small teams, solo developers and products with embedded PHP will patch slowest, and some legacy systems may never be updated. The practical step is to update PHP and review logs going back to October 17.