Overview
- Security researchers identified two critical vulnerabilities called PHP2Shell (CVE-2026-109618 and CVE-2026-109619) that permit remote code execution on affected servers and were publicly discussed after initial probe activity.
- Automated exploit attempts surged into the hundreds of thousands and then millions of requests within hours of public disclosure, driving a rapid race to apply fixes.
- The PHP project issued emergency updates that many hosts and administrators installed on Oct. 21, and most public websites taken offline as a precaution have since been brought back online.
- Experts warn that installing the patch does not remove any backdoors or stolen credentials so operators must review logs going back to the Oct. 17 probes, restart PHP processes, rotate keys and run forensic checks.
- The incident has prompted urgent political debate in Germany about national cyber‑security responsibilities, and highlighted how AI can speed both vulnerability discovery and exploit development.