PHP2Shell: critical unauthenticated RCE flaws hit a decade of PHP releases

Unauthenticated code execution at the core of the web

Two critical vulnerabilities in PHP, collectively known as PHP2Shell, surfaced during the week of 19–25 October 2026 and quickly turned into a serious security incident for web servers worldwide. According to Will Velida's Agent Security Update on dev.to, the flaws let unauthenticated attackers execute code remotely on affected servers — no account and no credentials required — with the potential to seize control of the machine or steal data.

A decade of releases in scope

The scale of the exposure is the alarming part. Velida writes that the vulnerabilities affect every PHP version released over the past decade, reaching back to 5.4. Citing figures from Wiz, the post also notes that PHP powers roughly 70% of the world's websites, including banking and government applications, so the pool of potentially reachable targets was enormous from the moment of disclosure.

Precautionary outages

Several organisations responded by pulling services offline rather than risk exploitation. The post names the Finnish government, the Netherlands' cyber-security agency and Wikimedia, the organisation behind Wikipedia, among those that took websites or pages down as a precaution while patches were applied. At the time of writing no breaches had been reported, although the author cautions that intruders have previously broken in, remained quiet for months and only acted later.

AI-assisted research and a broken embargo

Two details set this disclosure apart. First, the post credits researchers at Calif and Wiz with using OpenAI models in the discovery process, one of the clearer recent examples of AI accelerating defensive security work. Second, details of the vulnerability leaked before the coordinated embargo lifted, forcing PHP's developers to rush out both the disclosure and the fix ahead of schedule. For Velida, that compressed timeline underlines how quickly attackers — including autonomous agents able to act far faster than humans — can move once knowledge of a flaw escapes.

PHP weaknesses seen in live attacks the same week

The roundup gives a sense of why such urgency is warranted. Researchers at NorForge documented criminals pointing Cairn, an open-source AI penetration-testing system, at more than 1,200 sites belonging to over 100 companies, including Deere, SharkNinja and Cummins. One documented intrusion chain combined unauthorised write access to a memcached session store, unsafe PHP object deserialization and outdated Zend Framework code. NorForge estimated that roughly 10% of the attempts succeeded, though it could not confirm which AI models the attackers used.

Why it matters

PHP2Shell combines the worst properties of a web vulnerability: unauthenticated exploitation, full remote code execution and an install base spanning most of the web across a decade of releases. Organisations running PHP had to weigh exposing users to a pre-authentication RCE against taking services offline, and several — including national governments — chose the outage. The incident also signals a shift in how disclosures will play out: AI-assisted discovery means flaws may be found faster, while leaks and machine-speed attackers shrink the window for careful, embargoed patching. For administrators the message is blunt — patch, verify the fix landed, and keep monitoring for signs of compromise that may not surface for months.