Amazon says PHP2Shell flaws now being broadly exploited

Government, school and hospital websites across Europe went offline on Wednesday, Oct. 21. Operators were racing to protect their servers from two critical flaws in PHP, the programming language behind a large share of the web. Some organizations in the United States also took sites down. The flaws, CVE-2026-109618 and CVE-2026-109619, are known together as "PHP2Shell." Both are rated 9.2 out of 10, and either one can let an attacker run code on a server without logging in.apnews.com+2

PHP's developers released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at about 13:30 UTC on Wednesday. The release came a day early because the identifiers had leaked.detroitnews.com+2

Sites go dark

In the Netherlands, many organizations followed the National Cyber Security Centre in taking public sites offline. These included the Port of Rotterdam, the government portal Overheid.nl and numerous hospital sites. Finland's state IT centre Valtori shut down government web services. Germany's federal IT provider and France's Interior Ministry, which runs the prefecture sites, took pages down as a precaution. Belgium's foreign ministry did the same. In Denmark, the municipal IT company Kombit shut down several services, including the national school communication platform. Wikipedia, 4chan and DeviantArt were also disrupted.reuters.com+2

The NSA, the FBI and CISA all urged organizations to update right away or take their systems offline. CERT-EU, ENISA and Europol issued a joint statement telling organizations to isolate exposed applications until they could be patched.enisa.europa.eu+1

Found with AI

OpenAI said it led a coalition that spent two months on the flaws. It called them "one of the most impactful security issues in recent memory" and said AI appeared to find them before attackers did. The security group Calif found a flaw using an OpenAI model, and Google-owned Wiz discovered the bugs independently with AI. Wiz said the flaw had sat in PHP for about 20 years because exploiting it needed a chain of steps "at the edge of what human researchers could practically achieve".theverge.com+1

Attacks emerging

Early in the day, Cloudflare's chief technology officer said the company was "seeing early attacks emerging". Cloudflare later reported spikes of thousands of exploit attempts. On Wednesday evening, Amazon Threat Intelligence said PHP2Shell "is now being broadly exploited in the wild." It also said an attempt on Oct. 17 suggests one attacker may have known about the flaws early. CISA said Wednesday it had not seen exploitation.detroitnews.com+3

"What changed wasn't the underlying code, but the ability to find those weaknesses and turn them into working exploits," said Ismael Valenzuela of Arctic Wolf.apnews.com