PHP releases emergency patches for two critical PHP2Shell remote code execution vulnerabilities; exploitation attempts already observed

PHP released an emergency update fixing two critical vulnerabilities, collectively called PHP2Shell, that allow unauthenticated attackers to execute code on web servers, with a CVSS v4.0 score of 9.2. The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, affecting almost all versions dating back to PHP 5.4. The flaws are in the PHP runtime itself; servers using Apache mod_php are at highest risk, and a single unauthenticated request can trigger an attack before application code runs. The vulnerabilities were discovered by the Wiz, Calif and OpenAI Codex Security teams; researchers said AI models helped turn these flaws, which had existed for more than a decade, into working exploits, with one researcher completing in about a week work originally estimated to take a team months.