In a joint security disclosure published on October 21, 2026, cybersecurity research firm Wiz Research and maintainers from The PHP Foundation announced the remediation of PHP2Shell, a pair of critical memory safety vulnerabilities embedded in the core runtime of the PHP programming language. Tracked under CVE-2026-109618 and CVE-2026-109619, the flaws allow unauthenticated remote attackers to execute arbitrary shellcode or read sensitive memory contents across internet-facing servers regardless of application-level defense postures.

The discoveries carry monumental systemic weight across global internet infrastructure. According to web technology surveys, PHP underpins approximately 70% of all public web servers, serving as the foundational execution runtime for content management ecosystems including WordPress, Drupal, Joomla, and MediaWiki—the open-source platform hosting Wikipedia. The underlying memory management defects were traced back more than a decade to structural architecture choices enacted during the development of PHP 5.4, leaving nearly every PHP installation deployed over the last ten years vulnerable to attack.

Uncovering the exploit chain required frontier artificial intelligence. Wiz researchers detailed that while individual memory anomalies in the PHP runtime had been cataloged in past audits, constructing an end-to-end, unauthenticated remote code execution payload required navigating an intricate, multi-stage state machine that exceeded the practical manual modeling capacity of human exploit analysts. Using specialized frontier reasoning models developed in partnership with OpenAI's Patch the Planet defense initiative and boutique security consultancy Calif, the researchers automated the state-space exploration to verify reliable exploitation.

Exploitation mechanics operate along two primary threat vectors. Under CVE-2026-109618, attackers can trigger heap corruption within PHP's core memory allocator, steering instruction pointer execution to arbitrary memory locations without requiring prior authentication or active user sessions. Simultaneously, CVE-2026-109619 enables Heartbleed-style out-of-bounds memory disclosure, allowing remote adversaries to leak memory buffers containing database passwords, API credentials, private encryption keys, and active user session cookies from neighboring HTTP transactions on shared servers.

To prevent global disruption, the researchers adhered to a multi-week coordinated disclosure framework. Working alongside The PHP Foundation, cloud platforms, and edge networking providers like Cloudflare, maintainers engineered, tested, and backported fixes across supported release branches. The PHP Foundation deployed emergency releases PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday, urging hosting providers and enterprise administrators to patch immediately to prevent automated botnet weaponization.