MyTechDailyNews Explainer: PHP2Shell and the Hidden Web Layers Behind a Very Old PHP Bug

By Sarah Chen · Tech Daily · MyTechDailyNews General desk · Contact: hello@techdaily.com

Most people never think about the plumbing that holds the internet together, and that is exactly why this week’s story landed so hard. On Wednesday, PHP, the scripting language quietly running roughly 70% of websites, became the center of what researchers describe as one of the software world’s most severe vulnerability events, after two flaws that were more than a decade old became exposed almost overnight with artificial intelligence’s help.

The part that matters beyond website administrators is where the exposure sits. CISA warns that PHP’s prevalence “may not be directly observable,” which is why a manufacturer’s immediate risk may not live where many expect. PHP2Shell is currently considered unlikely to threaten industrial environments such as ERP, PLM and MES, because those systems generally aren’t built on the language. Instead, exposure may live in overlooked or poorly inventoried components around those platforms, including device consoles, supplier portals, legacy dashboards and third-party add-ons.

A leaked detail, an emergency patch and two 9.2-rated bugs

The trouble began on October 20, when details of two critical bugs — tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 in severity — leaked onto Hacker News and X, forcing PHP’s maintainers to scramble an emergency security patch before its planned release, according to a report by Ars Technica. Researchers quickly nicknamed the pair PHP2Shell. The defects had lurked undisturbed in PHP’s core code since version 5.4 was released in 2012.

Converting those longstanding defects into working exploits was not a simple job: cloud and AI cybersecurity firm Wiz said the task required complex chains of memory-corruption bugs, a process that AI substantially accelerated.

How frontier AI models compressed a specialist’s months into days

Working independently, researchers from Wiz and cybersecurity firm Calif used frontier AI models — including Gemini 4 Argon and GPT‑5.6 Sol — to accomplish in days what might once have required months from a specialist team. Their work chained obscure memory-corruption bugs into a working, unauthenticated remote-code-execution exploit against WordPress, Drupal and Joomla installations straight out of the box.

“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” the Wiz team wrote in a blog post, comparing the moment to the 2014 Heartbleed bug that shook the web’s encryption backbone. Wiz has since released an updated guidance document outlining the latest required actions.

The patch window, and the traffic that arrived ahead of it

By the time PHP’s security team pushed out patched versions — 8.2.35, 8.3.36, 8.4.27 and 8.5.12 — on October 21, damage control had already begun. Government agencies across Europe pulled public-facing websites offline as a precaution, including Dutch and Finnish government portals and France’s Interior Ministry. Amazon and Cloudflare later reported signs that attackers may have been testing exploitation attempts even before public disclosure.

Within hours of PHP’s October 21 disclosure, Cloudflare said it had logged millions of exploit attempts against the flaws.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching to the fixed releases — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — while cautioning that PHP’s footprint “may not be directly observable.” The agency said it had not observed active exploitation as of publication. Canada’s Centre for Cyber Security issued a parallel advisory, AL26-026, covering both CVEs for domestic organizations, and the Treasury Board of Canada confirmed the federal government was actively patching its own systems, with some government websites experiencing temporary disruption but no indication of compromise.

Vendor by vendor: what industrial and cloud suppliers said

Industrial vendors moved quickly to address whether their own products were exposed, and the answers differ enough to be worth reading side by side.

Company	What was reported	Why everyday readers and IT teams should care
Siemens	Acknowledged the two vulnerabilities in an advisory posted to its CERT portal — the site where Siemens publishes cybersecurity information, security advisories and vulnerability mitigation — saying more details were forthcoming. In a direct statement to Engineering.com, a Siemens spokesperson said: “Siemens is aware of zero-day flaws exploit on PHP and is actively working on the remediation of infrastructure, OT environment and affected products.”	Remediation is described as spanning infrastructure, the OT environment and affected products, so the answer is not a single patch on one box.
Cisco	Said it had found no products currently known to be affected, though it listed its Unified Industrial Wireless Software and IoT Control Center as “Under Investigation” in an advisory first issued October 21 and updated the following day.	“Under Investigation” is not the same as “not affected,” so tracking advisory updates matters.
Palo Alto Networks	Confirmed direct exposure, warning that all versions of its PAN-OS and Panorama appliance platforms are affected. The exposure is confined strictly to the management web interface rather than core traffic routing, and while Palo Alto evaluated the threat primarily as a potential service outage with no confirmed exploitation to date, official software fixes remain pending.	Administrative web screens are reachable attack surface even when data paths are untouched, and a fix may not exist yet.
Google	Said its cloud platform itself is not vulnerable, but customers running PHP applications on Google Cloud may be affected. While some supported runtimes receive automatic security updates, customers using their own container images must rebuild them with a patched version of PHP and redeploy.	Cloud hosting does not necessarily transfer responsibility for fixing the underlying runtime.

The fullest picture of the industrial fallout is still being assembled. A tracker maintained by the Dutch National Cyber Security Centre, NCSC-NL, had as of October 22 logged 635 products from roughly 430 suppliers — notably, no named ERP, PLM or MES platform appeared on the list. Two products flagged for investigation via third-party reporting stood out instead: Entelliweb, a building management system, and EfficientIP, a network automation platform. While neither has been confirmed as affected, these are the type of peripheral, easy-to-overlook web interfaces that may catch IT departments off guard.

Expert take: discovery is accelerating, process is not

“AI is changing the economics of cybersecurity. The speed at which vulnerabilities can be discovered and exploited is accelerating, while many organizations still rely on maintenance, patching and governance processes designed for a much slower world,” says Lionel Grealou, a digital transformation expert and author.

“The cybersecurity exposure of enterprise platforms goes well beyond their core technology. Integrations, extensions and bespoke applications create additional attack surfaces that organizations do not always manage with the same discipline as their core systems. Ultimately, cybersecurity is as much about lifecycle management and architectural accountability as it is about technology,” he says.

Four common misconceptions this event exposes

• “Our ERP, PLM and MES are the front line.” Those platforms generally aren’t built on the language, which is why PHP2Shell is currently considered unlikely to threaten them directly. The exposure is in what surrounds them.
• “Everything important is inventoried.” Device consoles, supplier portals, legacy dashboards and third-party add-ons are the overlooked or poorly inventoried components, and CISA’s own wording — PHP’s footprint may not be directly observable, — is a pointed warning for operators who don’t know everything on their network that quietly runs it.
• “The cloud provider handles the runtime for me.” Some supported runtimes receive automatic security updates, but customers using their own container images must rebuild them with a patched version of PHP and redeploy.
• “No confirmed exploitation means there is no urgency.” CISA said it had not observed active exploitation as of publication, yet Cloudflare logged millions of attempts within hours of the October 21 disclosure, and Amazon and Cloudflare later reported signs of testing before public disclosure.

A practical checklist for IT teams and site owners

1. Build an inventory of every runtime, appliance and embedded component on your network that runs PHP — because these flaws could be present in under-the-radar applications.
2. Map the overlooked layers around your core platforms: device consoles, supplier portals, legacy dashboards and third-party add-ons.
3. Move PHP to the fixed releases where applicable: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
4. Rebuild and redeploy any container images you own with a patched version of PHP rather than assuming a provider update will reach them.
5. Follow vendor advisories closely, including the Siemens CERT portal, Cisco’s advisory (updated the following day), Palo Alto Networks’ notice on PAN-OS and Panorama, and Google Cloud guidance.
6. Check the NCSC-NL tracker, which as of October 22 logged 635 products from roughly 430 suppliers, and review the two flagged items — Entelliweb and EfficientIP — as examples of the peripheral interfaces to look for in your own estate.
7. Treat management web interfaces as reachable attack surface, and weigh service-outage risk where official software fixes remain pending.
8. Read Wiz’s updated guidance document outlining the latest required actions, and plan maintenance, patching and governance with the faster discovery timeline in mind.

Frequently asked questions

What is PHP2Shell?

It is the nickname researchers gave to two flaws — CVE-2026-109618 and CVE-2026-109619 — in PHP, the scripting language running roughly 70% of websites. Each was rated 9.2 out of 10 in severity, and together they can be chained into an unauthenticated remote-code-execution path.

Which PHP versions contain the fix?

PHP’s security team pushed out patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, and CISA urged immediate patching to those fixed releases.

Is this mainly a factory-floor problem?

Not in the direct sense. Industrial environments such as ERP, PLM and MES generally aren’t built on the language, and no named ERP, PLM or MES platform appeared on the Dutch NCSC tracker. The concern is the web layer around industrial systems.

Why did these bugs stay hidden for so long?

They had lurked undisturbed in PHP’s core code since version 5.4 was released in 2012 — more than a decade. Wiz said turning them into working exploits required complex chains of memory-corruption bugs, work that frontier AI models including Gemini 4 Argon and GPT‑5.6 Sol completed in days rather than months.

How bad is this compared with older incidents?

Wiz called “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” and compared the moment to the 2014 Heartbleed bug.

Is any industrial product confirmed as affected?

Siemens acknowledged the two vulnerabilities and is working on remediation of infrastructure, OT environment and affected products; Palo Alto Networks confirmed direct exposure on PAN-OS and Panorama management interfaces; Cisco listed two products as under investigation; and while Two products on the NCSC-NL list, Entelliweb and EfficientIP, were flagged via third-party reporting, neither has been confirmed as affected.

What did governments tell organizations to do?

Alongside CISA’s call for immediate patching in the U.S., Canada’s Centre for Cyber Security issued advisory AL26-026 covering both CVEs, and the Treasury Board of Canada said it was actively patching federal systems, with temporary disruption on some government websites but no indication of compromise.

The bottom line for readers and operators

The lesson for anyone who simply uses the web is uncomfortable but simple: the software that breaks is often the layer nobody chose, named or counted. For organizations, the same event reframes the work. Patching the obvious servers is only the first line of a checklist that runs through consoles, portals, dashboards, add-ons, containers and appliance management screens — the hidden web layers that keep a business running without ever appearing on an org chart. Until that inventory exists, the exposure stays open, and the faster discovery timeline means the window to close it keeps shrinking.