Reporting snapshot · 22 October 2026. The patch and the national-security advisories are on the record, but no public authority has yet published a count of systems that were compromised before patching, and confirmed exploitation remains limited to early-stage reporting. The share of the internet said to be affected is a vendor estimate that has not been independently verified. This is a dated snapshot, not a live tracker.
What happened
The PHP project released emergency security patches on Wednesday, 21 October, for two critical vulnerabilities that allow an attacker to run code on a server without needing a password or any legitimate account, the PHP Foundation said. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and are widely referred to by the label PHP2Shell.
PHP is a server-side scripting language that runs on web servers to produce pages and connect to databases. It is not visible to most people, but it sits underneath an enormous share of the web: WordPress sites, Wikipedia, online shops and a large share of hosting platforms, according to Al Jazeera’s account of the disclosure.
The response was unusually fast and unusually high-level. The US National Security Agency issued a rare public warning advising organisations that could not patch immediately to take their systems offline, Al Jazeera reported. The UK’s National Cyber Security Centre published a formal alert the same day, stating that “organisations using any version of PHP are affected”.
Within hours, authorities across Europe and Asia began taking sites offline as a precaution. Germany’s federal digital transformation ministry shut down some websites, France’s interior ministry deactivated local administrative offices, and authorities in Belgium, the Netherlands, Finland and the Czech Republic followed, according to Reuters’s reporting carried by Al Jazeera. Japan’s prime minister, Sanae Takaichi, publicly urged people to check whether their websites ran on PHP. The Wikimedia Foundation said it had taken down “a number of other systems as a precautionary measure”, which left parts of Wikipedia unreachable for a time, the BBC reported. For individual visitors, the onus sits mainly with operators: Kanhere advised staying alert for security advice from affected services, such as requests to change passwords, and for phishing messages exploiting the incident’s publicity.
How the flaws work
The two vulnerabilities are different bugs with the same consequence. The first, CVE-2026-109618, sits in PHP’s memory management. According to the UK National Cyber Security Centre’s technical description, the issue can trigger an out-of-memory condition that corrupts memory, and under certain conditions that corruption can be exploited to achieve unauthenticated remote code execution.
The second, CVE-2026-109619, is a use-after-free error in the way PHP handles internal state. The NCSC explained that request-owned internal state can survive after its backing memory has been freed, so a later request handled by the same worker may use stale state before normal initialisation resets it.
What makes both serious is where they sit. The PHP Foundation said in its own statement that both issues live in memory management and error handling — “parts of PHP that nearly every request touches”. The Foundation also said that on Apache with mod_php, an unauthenticated request can trigger the first flaw before any application code even runs, and that full remote code execution was demonstrated with default settings. The EU’s Computer Emergency Response Team said the flaws could affect all versions dating back to PHP 5, released in 2004.
How AI found a decade-old bug
The discovery is notable less for the bugs than for the method. The PHP Foundation said the flaws were first reported on 11 August by a researcher at the security firm Calif, that OpenAI independently reported the same root cause the same day, and that researchers at Wiz reported further attack vectors on 24 August. All three worked with advanced AI tooling, largely through OpenAI’s Patch the Planet programme.
The Foundation’s own account adds a less comfortable detail. The out-of-memory problem had first been noticed by a core developer in 2024, and a potential exploit was theorised at the time, but no working attack path was found. The Foundation said fixing it stalled and restarted for months because every candidate fix traded off backward compatibility, performance, or coordination across a large extension ecosystem. It called the delay “a structural failure, caused by both the security team’s decision process and its lack of resources”.
That the bug survived so long is the story AI changes. As cyber-security researcher Salil Kanhere of UNSW Sydney told the BBC: “The underlying bugs weren’t new; what changed was our ability to find them.”
What website operators need to do
The single most important step is to update. The PHP Foundation said all PHP users should update immediately, and the NCSC’s guidance sets out a priority order worth reading in full.
In outline, the NCSC advises organisations to identify every system running PHP, prioritising internet-facing ones, and not to assume that only outdated versions are at risk; to update to the latest fixed version and apply additional hardening from the PHP team; to monitor for updates from third-party vendors whose products bundle PHP; and, if updating is not possible, to take the system offline until it can be fully mitigated. The NCSC also advises assessing a system for evidence of compromise and looking for backdoors before upgrading.
One detail often missed: the Foundation said users on PHP 8.1 or older should upgrade to a currently supported release, because the fix was only published for the latest branches.
Why this matters in Pakistan
For most Pakistani internet users, this is an invisible dependency. The country’s large freelance and software-export sector, its growing e-commerce base and a substantial WordPress-based web presence all run disproportionately on cheap shared hosting, where the runtime is chosen by the host rather than the customer. The National CERT’s March 2026 supply-chain advisory made exactly this point about unverified updates and vendor ownership.
That advisory is now concrete rather than theoretical. A site owner in Karachi or Lahore running an online store on a shared host may have no direct control over which PHP version is installed, and may not know PHP is involved at all. The NCSC’s instruction to inventory PHP installations “generally” and not only outdated ones is aimed precisely at organisations in that position.
It is worth being careful, though, not to overstate the local exposure. KhabarWire found no Pakistani government confirmation of affected systems, and no national CERT advisory on these specific flaws had been published at the time of writing. Separately, Pakistan’s National Cyber Security Handbook 2026-27 bars officials from feeding sensitive data to public AI tools, and the National CERT has set tiered registration rules for cybersecurity consultants.
What is still uncertain
The most important open question is whether these flaws were actually used against real systems before operators patched. The PHP Foundation said its security team inspected emerging proof-of-concept code after the disclosure leak and did not identify any functional exploits at the time of release. That was true on 21 October, and it is the most recent authoritative assessment available.
Later reporting is less settled. Dane Knecht, chief technology officer at Cloudflare, said he was “seeing early attacks emerging” and was updating mitigations as new vectors appeared, the BBC reported. That is the clearest public indication of active exploitation, but it is one executive’s statement at one company, not a measured national or industry figure. No authority has published a count of compromised systems.
The scale estimates should be read with similar caution. Wiz estimated that “roughly 70%” of the internet is affected, and Al Jazeera’s headline repeated that figure. The BBC said it could not verify it. It is a vendor estimate about what runs PHP, not a measurement of exposed or attacked systems.
The other unresolved issue is the disclosure itself, which failed twice. The PHP Foundation said the two CVE identifiers began circulating on forums and social media on Tuesday, 20 October, two days before the planned release, carrying a wrong release time and an incorrect CVSS score of 10.0 when the real score is 9.2. That forced the project to bring its pre-announcement forward, and a proof-of-concept video was published and then deleted, with copies circulating afterwards. Then, at 07:41 UTC on 21 October — more than six hours before the coordinated release — the Chainguard container image distributor published built images containing the fix, letting attackers study the patch in binary form while other users were still waiting.
How many systems were exposed during that window will decide how significant this episode turns out to be, and nobody has yet published the answer.
