Two critical PHP security vulnerabilities have triggered a surge in reported hacking attempts, prompting cybersecurity agencies to urge organisations to update affected systems. Cloudflare CEO Matthew Prince reported that attempted exploitation rose from thousands to millions after the flaws became public.
Identified as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities could allow attackers to execute malicious code on affected servers without authentication. The PHP development team released security fixes and urged users to update immediately.
Key Highlights
- Millions of attempts reported: Cloudflare observed a sharp rise in attempted exploitation after public disclosure.
- Two critical flaws: Both vulnerabilities could enable remote code execution on affected systems.
- AI-assisted discovery: Google Cloud credited AI models with helping researchers identify and investigate the flaws.
- Security patches available: Fixed PHP versions were released recently.
- Urgent security response: Cybersecurity agencies have advised organisations to update vulnerable installations and monitor for suspicious activity.
What Are the Two PHP Security Vulnerabilities?
PHP is a widely used programming language that powers websites, web applications, and content management systems.
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are associated with the name PHP2Shell. Both carry a Critical severity rating, with a CVSS score of 9.2, according to Google Cloud.
The flaws involve memory-handling and internal-state management issues. Under certain conditions, attackers could exploit them to execute arbitrary code on affected servers without logging in.
This type of attack, known as remote code execution, can give attackers the ability to run malicious commands on a vulnerable system. The potential impact depends on the server configuration and the privileges available to the exploited process.
How Did Hacking Attempts Reach Millions?
According to ABC News, Cloudflare reported a rapid increase in attempted exploitation after the vulnerabilities became public.
Cloudflare CEO Matthew Prince described the progression in a post on X:
- Before public disclosure: Thousands of attempts over 10 hours.
- First 45 minutes after disclosure: Tens of thousands of attempts.
- Within two hours: Hundreds of thousands of attempts.
- Numbers: Millions of attempts reported.
These figures reflect Cloudflare’s observations across its network. They do not establish how many unique attacks occurred, how many websites were targeted, or how many systems were successfully compromised.
The surge highlights the speed at which attackers can begin targeting newly disclosed software vulnerabilities. Organisations that delay security updates may face greater exposure as exploit techniques become more widely available.
How Did AI Help Identify the PHP Vulnerabilities?
AI played a role in the research behind the PHP flaws. In a technical update published on 21 October, Google Cloud said researchers used a combination of AI models to identify and help remediate the vulnerabilities.
Google specifically credited Gemini 4 Argon with contributing to vulnerability discovery, exploit development, attack detection, and patch validation.
The findings illustrate how AI can help security researchers identify software weaknesses and validate fixes. However, the research does not establish that AI independently carried out every stage of the discovery process.
Which PHP Versions Need a Security Update?
The PHP development team released fixes on 21 October 2026 for the following versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
The PHP project no longer provides standard updates for PHP 8.1 and older versions. Some operating-system vendors and long-term support providers may offer backported security fixes, so administrators should check their vendor’s guidance.
The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The official PHP advisory identifies mod_php as particularly at risk because a demonstrated exploit can trigger the flaw before application code runs.
What Should Website Owners Do Now?
Website owners and administrators should take the following steps:
- Update PHP: Install the appropriate fixed version or vendor-provided security package.
- Check exposed systems: Identify internet-facing PHP installations, applications, containers, and third-party products that may include vulnerable PHP components.
- Review security logs: Look for suspicious requests, unexpected processes, unfamiliar files, and unusual outbound connections.
- Follow vendor guidance: If an immediate update is not possible, consider isolating exposed applications until the fix can be applied.
- Investigate suspicious activity: If signs of compromise appear, follow an incident-response process rather than relying on patching alone.
The PHP security team recommends updating as the complete solution. Temporary mitigations may reduce exposure to particular attack paths but do not make a vulnerable installation fully safe.
What Happens Next?
The priority is to patch affected PHP installations and investigate any signs of compromise. Millions of attempted exploits have been reported; he cited that reporting does not establish the number of successful breaches.
Website owners should follow official security advisories, apply the relevant updates, and continue monitoring their systems as further information becomes available.
