The global PHP internet security flaw—collectively dubbed PHP2Shell—consists of two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that impact PHP, a programming language powering roughly 70% of the world's websites. Discovered by cybersecurity firm Wiz Research using OpenAI's GPT-5.6 Sol model (alongside cybersecurity firm Calif), the flaw represents a massive memory-disclosure and unauthenticated remote code execution (RCE) risk inherent to core PHP
Because it affects nearly every version of PHP released over the past decade, it leaves major platforms like WordPress, Wikipedia, and countless corporate and government web servers vulnerable to complete attacker takeover, data theft, and defacement.
How the Flaw is Being Fixed
The global response to secure the internet’s infrastructure involves immediate software updates and coordinated defensive action:
Official Software Patches: The PHP Foundation rapidly developed and released official security patches on October 21, 2026, correcting the memory-safety vulnerabilities in the core engine.
Urgent Server Upgrades: Government agencies, cloud providers, and website operators worldwide are in an emergency race to download and apply these updates. Cyber-defense teams must update their underlying PHP server environments, as simple website configuration changes are not enough to stop the exploit.
Preemptive Website Shutdowns: To prevent hackers from weaponising the flaw before systems can be updated, several European government agencies, major infrastructure operators, and media outlets temporarily took their websites offline or suspended services to apply the fixes in a secure environment. [1, 2]
Global Cyber Agency Advisories: Government groups including the US National Security Agency (NSA) and Europe's cybersecurity agency have issued urgent directives ordering all organizations using PHP-supported content management systems (like Drupal or WordPress) to patch immediately.
Are you managing a PHP-based website or server that needs to be checked, or would you like to know more about how AI models like GPT-5.6 Sol are changing cybersecurity?