# Critical PHP2Shell vulnerabilities expose 69% of websites to unauthenticated RCE

> **Key takeaway:** Two twenty-year-old PHP bugs, now exploitable with AI assistance, enable unauthenticated remote code execution on servers running the language that powers nearly 70% of websites.

**Published:** 2026-10-21T20:37:21+00:00 
**Source:** The Verge 
**Category:** foss-apps 
**Canonical URL:** https://fosswire.org/news/critical-php2shell-vulnerabilities-expose-69-of-websites-to-.html 

## Summary
Two critical vulnerabilities in PHP, dubbed PHP2Shell, have prompted major sites including Wikipedia, 4chan, and DeviantArt to take services offline. Dutch and Finnish government agencies also shut down sites as a precaution. The NSA and UK NCSC recommended taking systems offline if patching is not immediately possible. The bugs, present in PHP for roughly 20 years, were discovered using AI tools by OpenAI's Calif group and Google's Wiz. They allow unauthenticated remote code execution on any PHP server.

## The two CVEs and what they enable
- **CVE-2026-109618** (RCE via OOM corruption): Out-of-memory handling can interrupt PHP while internal request data is only partially initialized; request cleanup then treats invalid data as valid
- **CVE-2026-109619** (RCE via stale global state): Request-owned internal state survives after its backing memory is freed; a later request on the same worker may use that stale state before normal initialization resets it
- Both allow **unauthenticated remote code execution** without administrator credentials
- PHP Group states any site running PHP is at risk; Cloudflare CTO reported early attacks emerging
- PHP 8.1 and older are unsupported and will not receive official fixes

## Why it matters
The vulnerabilities affect the server-side language behind an estimated 69.3% of known websites. Wiz described the bugs as "among the most severe vulnerabilities discovered in software history," and the PHP Group confirmed that attackers could gain full server control, access passwords, API keys, certificates, and databases, then use compromised servers to attack others.