KEVWire

Security intelligence, with context.

Response snapshot Oct 26, 2026, 18:57 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-109619Known exploitation

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

Published Updated

At a glance

Exploited
Yes: reported by a cited source
Severity
9.2 Critical (CVSS 4.0)
Chance of exploitation
100.0% in the next 30 days
Sources
8 independent sources

What to do

Check the vendor advisory linked from the article for affected versions and fixes.

Read NVD CVE-2026-109619 (opens a new tab)

What happened

The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.

Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.

Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix.

Continue reading

The disruption put the National Security Agency and Europe's cybersecurity agency on alert.

State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.

What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory."

"To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said.

The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

Read more below.

What is PHP?

You've probably never heard of PHP, even though you've interacted with it for decades.

PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.

It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.

It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites.

How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.

What was the PHP vulnerability, exactly?

AI researchers discovered two critical vulnerabilities in PHP that could allow an attacker to take control of a website's server without having legitimate access to it.

Hackers could exploit the flaws, dubbed " php2shell " by cybersecurity firms, to steal information from those websites.

Between the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz.

Why cybersecurity incidents are a big deal

Thought bubble via Axios' Bradley Olson : The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug.

But the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins at public companies and more.

A major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain.

Cyber pros are calling the series of attacks "Black October" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm.

While defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem.

The bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic.

As with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.

Scores and how they were measured

CVSS base severity

9.2

Version 4.0As of

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

100.0%

Scored Percentile 100.0%

Model and measurement source (opens a new tab)

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Sources

  1. Reporting

    Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency (opens a new tab)

    The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed.

    Published Checked

  2. Reporting

    Axios syndication feed (opens a new tab)

    The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt.

    Published Date not suppliedChecked

  3. Primary source

    NVD CVE-2026-109619 (opens a new tab)

    NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation.

    Published Checked

  4. Primary source

    Vendor advisory (via NVD references) (opens a new tab)

    The vendor advisory referenced by the CVE record, for affected versions and fixes.

    Published Date not suppliedChecked

  5. Primary source

    NVD CVE API 2.0 (opens a new tab)

    The NVD API page that supplied this CVE record.

    Published Date not suppliedChecked

  6. Primary source

    JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (updated) (opens a new tab)

    Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt.

    Published Checked

  7. Primary source

    JPCERT/CC Japan Advisories syndication feed (opens a new tab)

    The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt.

    Published Date not suppliedChecked

  8. Reporting

    The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware (opens a new tab)

    The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed.

    Published Checked

  9. Reporting

    The Hacker News syndication feed (opens a new tab)

    The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt.

    Published Date not suppliedChecked

  10. Reporting

    The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity (opens a new tab)

    The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed.

    Published Checked

  11. Reporting

    The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed (opens a new tab)

    The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed.

    Published Checked

  12. Reporting

    The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge (opens a new tab)

    The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed.

    Published Checked

  13. Reporting

    The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't (opens a new tab)

    The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed.

    Published Checked

  14. Reporting

    The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (opens a new tab)

    The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed.

    Published Checked

  15. Reporting

    SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities (opens a new tab)

    The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed.

    Published Checked

  16. Reporting

    SecurityWeek syndication feed (opens a new tab)

    The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt.

    Published Date not suppliedChecked

  17. Reporting

    SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells (opens a new tab)

    The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed.

    Published Checked

  18. Reporting

    SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge (opens a new tab)

    The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed.

    Published Checked

  19. Reporting

    The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits (opens a new tab)

    The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed.

    Published Checked

  20. Reporting

    The Record (Recorded Future News) syndication feed (opens a new tab)

    The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt.

    Published Date not suppliedChecked

  21. Reporting

    WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched (opens a new tab)

    The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed.

    Published Checked

  22. Reporting

    WIRED Security syndication feed (opens a new tab)

    The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt.

    Published Date not suppliedChecked

  23. Primary source

    FIRST measured EPSS score (opens a new tab)

    Measured EPSS probability and percentile for CVE-2026-109619, scored 2026-10-25. This is a model estimate, not proof of exposure.

    Published Checked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 26). PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (CVE-2026-109619). https://kevwire.com/record/CVE-2026-109619

MLA

"PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (CVE-2026-109619)." KEVWire, 26 Oct. 2026, kevwire.com/record/CVE-2026-109619.

Chicago

KEVWire. "PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (CVE-2026-109619)." Last modified October 26, 2026. https://kevwire.com/record/CVE-2026-109619.

Evidence summary (plain text)

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (Oct 22, 2026).
The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

 Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.

 Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.

 Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. 

 The disruption put the National Security Agency and Europe's cybersecurity agency on alert.

 State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.

 What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory."

 "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said.

 The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

 Read more below. 

 What is PHP?

 You've probably never heard of PHP, even though you've interacted with it for decades.

 PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.

 It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.

 It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. 

 How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.

 What was the PHP vulnera
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109619).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109619&date=2026-10-25).
Sources:
Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency: https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites
Axios syndication feed: https://api.axios.com/feed/
NVD CVE-2026-109619: https://nvd.nist.gov/vuln/detail/CVE-2026-109619
Vendor advisory (via NVD references): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (updated): https://www.jpcert.or.jp/at/2026/at260033.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware: https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity: https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html
The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed: https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge: https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't: https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html
The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert: https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities: https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/
SecurityWeek syndication feed: https://www.securityweek.com/feed/
SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells: https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/
SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits: https://therecord.media/php-php2shell-exploitation-attempts-pocs
The Record (Recorded Future News) syndication feed: https://therecord.media/feed
WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched: https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
WIRED Security syndication feed: https://www.wired.com/feed/category/security/latest/rss
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109619&date=2026-10-25
Record ID: CVE-2026-109619.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Documented by a cited source.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 26, 2026, 13:40 UTC. Ingestion is not an independent editorial investigation.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are not available yet. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail