Two flaws in the software that runs websites
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, sit in the core of PHP itself rather than in any single website built with it. Both received a severity score of 9.2 out of 10. The first triggers when a visitor’s request uses up all the memory PHP allows, which leaves PHP’s internal records half-finished and later corrupts its memory in ways attackers can exploit. The second occurs when a serious error leaves PHP pointing at leftover data from an earlier visitor, and the next visitor’s request then uses that stale data.
Why so many websites are exposed
PHP runs WordPress, Drupal, Magento, Laravel, MediaWiki, and countless custom business applications. The flaws trace back more than a decade, to around the PHP 5.4 era, so nearly every PHP installation that serves web pages carries them. Updating WordPress or any other application does nothing to fix the problem, because the weakness lives in the underlying PHP software. Hosting companies, online shops, government sites, and small blogs all share the same exposure.
What an attacker can do
An attacker needs no login and can strike with a single request, which lets them run their own commands on the server with the same permissions as the web server program. On Apache servers using a setup called mod_php, the attack lands before the website’s own code starts running, so security features built into the site cannot stop it. Once inside, an attacker can steal customer data, passwords, and encryption keys, read information from other visitors’ requests, or use the server as a stepping stone to reach other systems. The flaws can also be used simply to crash a site.
A disclosure that went wrong
Security firm Calif, working with OpenAI’s Patch the Planet initiative and using AI models, reported the first serious flaw in August 2026, and OpenAI and the security firm Wiz independently reported the same issue shortly after. The PHP project planned a coordinated release, but on October 20 the CVE numbers and release timing began circulating early, and a proof-of-concept video showing the attack was published by mistake before being deleted. The next day, the software company Chainguard published fixed software hours ahead of the official release, which let outsiders study the repair while others still waited. Cloudflare then reported attack attempts, and the NSA, FBI, UK National Cyber Security Centre, Canadian Centre for Cyber Security, and CERT-EU all issued urgent alerts, with some European governments taking sites offline as a precaution.
Market Impact
PHP2Shell crisis created an immediate demand for cybersecurity firms as organizations required emergency scanning, patch deployment, WAF updates, and incident response for PHP installations. Companies that identified the flaws early secured greater visibility and trust, while circulating exploits and scanning activity generated sustained work in threat intelligence and remediation for unpatched systems. The incident demonstrated the market value of fast AI-supported research and proactive defenses, making these providers as primary responders in major infrastructure emergencies.
This marketing material is provided for informational purposes only and does not constitute investment advice, a recommendation, or an offer or solicitation to buy or sell any financial instruments.
Trading in securities involves significant risk and may not be suitable for all investors. Prices of securities may fluctuate significantly and may result in a total loss of your investment. Investors should be aware that losses may exceed potential profits when buying and selling securities. In certain market conditions, you may sustain losses that exceed your initial investment. Securities and contracts for differences are complex financial instruments that require a high level of knowledge and understanding. You should carefully consider whether you understand how these instruments work and whether you can afford to take the high risk of losing your money.
Source: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
