This week, a massive chunk of the internet was forced to go offline. 4chan went read-only. Parts of Wikipedia shut down. Government websites in the UK, Netherlands, and France were pulled offline. Even BreachForums—a literal website for hackers—took itself down.
This wasn't a massive DDoS attack. It wasn't a foreign nation-state cyberattack. It was all because of two lines of code in PHP, the backend language that powers roughly 70% to 80% of the entire web.
Security researchers are calling it the worst-case scenario for web infrastructure, comparing it to Heartbleed and Log4Shell. The exploit is called PHP2Shell, and it scores a staggering 9.2 out of 10 on the CVSS severity scale.
Here is exactly what happened, why it’s so terrifying, and what you need to do right now.
- A critical 9.2/10 vulnerability (PHP2Shell) was discovered in the core PHP runtime, affecting 70% of the web.
- The bug allows Remote Code Execution (RCE) without authentication, meaning attackers can take over servers.
- The flaw existed since 2004, but AI tools were used to finally build a working exploit.
- Major websites and government portals were taken offline as a precautionary measure.
- Patching PHP is the only fix. Updating WordPress or CMS plugins does not work.
1. The Bug: It’s the Language, Not the Plugin
To understand the panic, you need to know how PHP works. When you load a website (like WordPress, Drupal, or Joomla), your server spins up a "worker" to build the page. This worker handles multiple requests from different users at the same time.
Usually, when a security bug is found in a web app, you just update the app or a plugin. This is different. The bug is in the core PHP runtime itself. That means the bug triggers before your website code even runs. Even a fresh "Hello World" application is vulnerable.
There are two separate bugs (CVE-2026-109618 and CVE-2026-109619) that can be chained together for Remote Code Execution (RCE). This means an attacker can send a malicious request to your server and run their own code without logging in.
Here is how it works in plain English:
- The Out-of-Memory Crash: An attacker sends a request designed to exhaust the server's memory limit exactly at the wrong moment. PHP drops the request, but it leaves half-finished data behind.
- The Stale State (Use-After-Free): When the next request comes in, the server reuses that same memory. But PHP still has a pointer looking at the old, half-finished data.
- The Takeover: The attacker shapes that leftover memory to execute their own commands.
Companies like Wiz, who helped discover it, demonstrated the exploit on fully updated versions of WordPress, Drupal, and Joomla. They even proved they could pull passwords and API keys straight out of the server's memory.
2. The Leak: How Chaos Erupted
Normally, when a bug this bad is found, there is an "embargo." The researchers tell the software developers quietly, they build a patch, and everyone releases the fix on the exact same day. This gives webmasters time to update before hackers find out.
But this week, the embargo completely fell apart.
On Tuesday, someone posted the CVE numbers on Hacker News, claiming the bugs were a perfect 10/10 (they were slightly off, but close). That evening, a security firm accidentally published a video showing the exploit working in real-time before taking it down. Then, early Wednesday morning, a container company shipped patched images more than six hours before the official release.
Because the news leaked early, attackers had a head start. Cloudflare reported seeing a massive wave of exploit attempts—with payloads changing constantly—before the official patch even dropped.
3. The AI Factor: 20 Years of Theory Becomes Reality
Here is the craziest part of this story: This bug has been sitting in PHP since version 5.4, which was released in 2004.
Researchers have suspected this area of PHP was vulnerable for over two decades. A security audit in 2024 even found the first signs of it. But back then, no one could figure out how to turn the theory into a working exploit.
So what changed? Artificial Intelligence.
Earlier this year, security researchers fed PHP's codebase into advanced LLMs. The AI didn't just find the bug; it figured out the exact sequence of requests needed to exploit it. What would have taken a world-class human team 10 months to figure out, AI helped map out in a single week.
As one researcher noted, "We were so worried about robots hallucinating, and at this point, it's really the humans that are kind of hallucinating. We don't even know what we're doing."
4. It Wasn't Just PHP
To make matters worse, October 21st was a bloodbath for cybersecurity. The PHP bug was just the headline.
- GitLab released a patch for a perfect 10/10 vulnerability that allowed unauthenticated attackers to execute code on self-hosted servers.
- Node.js patched ten vulnerabilities, including high-severity RCE bugs in its Brotli compression.
- Railway (a hosting platform) disclosed a security incident where attackers may have accessed encrypted customer environment variables, potentially exposing database and API keys.
- eMudhra, a certificate authority, generated intermediate keys so poorly that anyone could reverse-engineer them.
5. What You Need to Do Right Now
If you host a website, run a server, or manage web apps, this cannot wait.
- Update PHP Immediately: The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you are on PHP 8.1 or older, there is no official fix for you. You must upgrade to a supported branch or use a patched package from your Linux distribution.
- Update Your Infrastructure: Do not just update WordPress or your CMS. The bug is in PHP. After updating, you must restart your PHP workers and rebuild your containers. Otherwise, the old, vulnerable PHP will keep running in memory.
- Can't Patch? Take it Offline: The NSA, FBI, CISA, and UK's NCSC all issued the same drastic advice: if you cannot patch immediately, disconnect the server from the internet.
- Rotate Your Secrets: If you use Railway, check your environment variables immediately. Changing the variable in Railway isn't enough; you have to revoke the old API keys and generate new ones at the source (AWS, Stripe, OpenAI, etc.) and then redeploy.
6. Frequently Asked Questions
Does updating WordPress fix the PHP2Shell vulnerability?
No. The vulnerability is in the PHP runtime itself, not in WordPress or its plugins. You must update the PHP version on your server (e.g., via cPanel, your hosting dashboard, or your Linux package manager).
I am using PHP 8.1. Is there a patch for me?
PHP 8.1 is past its official end-of-life and does not have an official patch from the PHP Foundation. You must either upgrade to PHP 8.2 or newer, or check if your Linux distribution (like Ubuntu or Debian) has released a backported security patch.
What does RCE mean?
RCE stands for Remote Code Execution. It is the most severe type of vulnerability. It means an attacker can send a malicious request to your server and execute their own code on it, potentially stealing data, installing malware, or taking complete control.
Is it safe to browse the web right now?
Yes, for the average user. This vulnerability affects the servers that host websites, not the web browsers on your phone or computer. However, you should avoid entering sensitive information on websites that haven't been updated recently.
7. Final Thoughts
The internet survived this week, but the sheer scale of the PHP bug proves that the era of relying on coordinated disclosure might be over.
When AI can find and exploit zero-days in hours, "Patch Tuesday" needs to become "Patch Every Day."
If you run PHP anywhere—even on some forgotten server in the corner of your home lab—go update it. The worst-case scenario is no longer a theory.
Found this guide helpful?
Explore more cybersecurity alerts, tech news, and AI deep-dives.
Explore More Tech Guides →