Published October 25, 2026. Last updated October 25, 2026.
Last week, governments and big websites pulled pages offline on purpose. Not because they were hacked. Because they were scared of what might happen before they could patch.
The cause is a pair of flaws in PHP, nicknamed PHP2Shell. Security people started calling the whole stretch of bad news “Black October.”
If you run a website, there’s a good chance this touches you. Here’s what’s confirmed, what’s hype, and what to check today.
Quick answer
What is PHP2Shell? Two critical flaws in PHP that let an attacker run code on a web server without logging in. They’re tracked as CVE-2026-109618 and CVE-2026-109619.
Is there a fix? Yes. PHP released patches on October 21, 2026. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Was AI involved? Yes. Researchers used AI models to find the flaws. Attackers are also using AI to build exploits faster.
What should you do? Check your PHP version today. If it isn’t a fixed one, update it or ask your host to.
What is PHP2Shell?
PHP is the language behind a huge share of the web, including WordPress. PHP2Shell is two bugs that live inside PHP itself, not in a plugin or a theme.
- CVE-2026-109618 is a memory corruption bug. If PHP runs out of memory at the wrong moment, cleanup can treat half-built data as valid.
- CVE-2026-109619 is a stale-state bug. Data from one request can survive after its memory is freed, and a later request may use it.
According to Help Net Security, a working exploit shows a single unauthenticated request can trigger the attack before any of your application code runs. Every PHP setup that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups using mod_php face the biggest danger.
Does PHP really run 70% of the web?
Roughly, yes, with a catch. Axios says PHP is used by about 70% of websites whose server-side language is known. That’s not the same as 70% of every site on earth. Still, it’s a very big number.
How did AI find the flaws?
Researchers at Wiz, Calif and OpenAI pointed AI models at PHP. OpenAI said: “To our knowledge, frontier AI found these vulnerabilities before attackers did.”
Wiz said the bugs went unnoticed for more than a decade because exploiting them takes complex technical work, which AI helped with.
Others got there too. Chainguard’s CEO, Dan Lorenc, said his team found the same bugs on their own by asking a frontier AI model to hunt for serious vulnerabilities in PHP. Trail of Bits said one engineer built a working exploit in a single day using Codex. Its CEO, Dan Guido, pointed out that turning a bug into a shell still takes expertise. AI just makes that expertise faster.
What happened between discovery and the patch?
- October 17: Amazon’s honeypot recorded an exploitation attempt, four days before public disclosure. How the attacker got details early is still unknown.
- October 21: PHP shipped the fixes. 404 Media reports Chainguard posted fixes a few hours early, which drew criticism for breaking the embargo.
- After the patch: Cloudflare’s CEO, Matthew Prince, posted that Cloudflare saw thousands of exploit attempts in the ten hours before the announcement, and millions afterward. That’s a company figure from a social media post, not an independent count.
Why did websites go offline?
Governments and companies took sites down on October 21 while they installed patches. Axios reports dozens of sites in the US, UK and elsewhere went briefly offline. The UK’s NCSC urged organizations to consider taking offline any system they couldn’t fix right away, and State of AI reports the NSA gave similar advice.
Some famous sites, including the Internet Archive, 4chan and parts of Wikipedia’s infrastructure, also went down. According to State of AI, the operators took them down themselves and no intrusion was reported.
That matters. So far, most of the damage has been disruption, not confirmed mass breaches.
What is “Black October”?
It’s a nickname for a run of security incidents that landed in the same few weeks. PHP2Shell is the biggest one. Others reported in coverage include:
- LiteLLM 1.107.0: A hijacked update pipeline shipped a credential stealer on October 21. It was live for roughly two hours.
- eMudhra: An Indian certificate authority created eight keys so weak that a researcher cracked them quickly. Browser makers acted against the affected certificates.
- Railway and Zeabur: Both said attackers may have read customer secrets.
- GitLab: A flaw rated 10 out of 10 was patched.
- Storm-0940: Microsoft disclosed a campaign it says used an AI tool to go from first probe to cloud control in under three hours in some cases.
Be careful with the scary lists you see online. State of AI notes that a widely shared list of “27 hacks” exaggerates in places and mixes in older incidents. And 404 Media says a lot of AI-written exploit code floating around probably doesn’t work. Real danger, plus a lot of noise.
What about CERT-In and the “days to hours” warning?
India’s CERT-In made a related point on October 15, six days before the PHP patches. Its advisory said agentic AI tools cut the time from first access to final damage from days to a few hours. That advisory was about AI agents in general, not about PHP2Shell. I covered it here: India’s cyber agency says AI agents broke into live systems.
The two stories point the same way. Finding a hole and using it are both getting faster. Installing the fix is the slow part, and that part is still on us.
What should website owners do today?
- Check your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. Or look in your hosting panel.
- Update to a fixed version. That means 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. If you’re on shared hosting, ask your host whether they’ve patched.
- Don’t ignore old versions. PHP no longer supports 8.1 and earlier. PHP released minimal source patches for 7.4, 8.0 and 8.1, but most people should upgrade or ask their host about a backported fix. Two scanning firms estimated that a large share of exposed PHP servers run versions with no official fix, at 59% and 79% (their methods differ).
- Turn on a WAF. Cloudflare says PHP sites behind its network get an initial set of rules for known exploit paths, including on free plans. A WAF is a stopgap, not a fix.
- Scan yourself. Searchlight Cyber released an open-source tool called php2shell-scanner that tests whether a host is exposed.
- Look at your logs. Security vendor D3 suggests hunting for repeated HTTP 500 errors, memory-limit errors and unexplained worker restarts. Treat that as a hint, not proof.
- Rotate secrets if you touched LiteLLM. If anyone installed LiteLLM 1.107.0 on October 21, change every password and key that machine could reach.
- Update everything else. Turn on automatic updates and two-step login for email and banking. Update self-hosted GitLab today.
One honest warning. Patching closes the door. It doesn’t throw out anyone who already walked in. If you saw signs of attack before October 21, change your passwords and keys too.
What we still don’t know
- How the attacker in Amazon’s October 17 sighting got exploit details before disclosure.
- How many sites have actually been compromised. So far the reporting describes mostly takedowns and patching, not large confirmed breaches.
- How fast the world is really patching. Many sites likely haven’t.
- Which numbers hold up. Several attack-volume figures are company-reported.
FAQ
What is PHP2Shell?
PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also released minimal source backports for 7.4, 8.0 and 8.1, which are no longer officially supported.
Is my WordPress site affected?
If it runs on an unpatched PHP version, yes, it’s exposed. The flaw is in PHP, not in WordPress. Check your PHP version and ask your host to update it.
What does Black October mean?
It’s a nickname security professionals gave to a cluster of major incidents in October 2026, including PHP2Shell, a malicious LiteLLM release and several platform breaches.
Did AI really find the PHP flaws?
Yes. Researchers at Wiz, Calif and OpenAI used AI models, and Chainguard says it independently found the same bugs the same way.
Should I take my site offline?
Only if you can’t patch. UK authorities advised considering that for systems that can’t be fixed right away. For most site owners, updating PHP quickly is the better move.
Bottom line
PHP2Shell is serious, but it isn’t the end of the internet. The fix exists. The risk now sits with everyone who hasn’t installed it.
AI sped up the finding, the exploiting and the fixing. It didn’t speed up the part where a real person logs in and clicks update. Do that today.
Sources
- Help Net Security: PHP2Shell vulnerabilities patched
- Axios: Black October, why bugs discovered by OpenAI tech are creating a cyber emergency
- 404 Media: AI is changing everything about hacking
- State of AI: Inside Black October
- D3 Security: What PHP2Shell and AI-powered attacks mean for the SOC (vendor blog)
- CybelAngel: Critical PHP RCE vulnerabilities (headline figure only)