Security researchers are reporting exploitation attempts targeting two critical flaws in PHP, prompting urgent calls to patch the widely used web technology.
Two critical vulnerabilities in PHP are facing active exploitation attempts, creating an urgent need for widespread patching, according to cybersecurity researchers.
The vulnerabilities—together known as “PHP2Shell” and considered a “critical” risk with severity ratings of 9.2 out of 10.0—can enable attackers to execute code remotely without authentication. PHP is a key technology behind numerous web platforms including WordPress and Drupal.
[Related: 10 Major Cyberattacks And Data Breaches In 2026 (So Far)]
“With 70 percent of the Internet affected, the impact of PHP2Shell cannot be overstated,” researchers at Google-owned Wiz wrote in a post.
PHP released security updates Wednesday addressing the flaws after details about the vulnerabilities were leaked ahead of a planned coordinated disclosure.
What follows are five things to know about the “critical” PHP vulnerabilities and exploitation activity.
Exploitation Attempts Underway
Researchers at cybersecurity firm WatchTowr said Wednesday that it has been observing active exploitation attempts targeting both of the critical vulnerabilities, which are tracked as CVE-2026-109618 and CVE-2026-109619.
The reporting from WatchTowr did not identify the threat actors behind the activity or establish how many organizations had been compromised.
Cybersecurity vendor Huntress, meanwhile, said it had not observed in-the-wild exploitation across its partner base as of 10 a.m. Eastern Time Wednesday.
“However, others are reporting that they are seeing attacks emerging,” wrote John Hammond, principal security researcher at Huntress, in a blog post. “As such, updating promptly to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 is critical.”
Vulnerability Details
The two PHP2Shell vulnerabilities involve failures in how PHP handles data in memory when an error interrupts a web request, according to researchers.
Successful exploitation can provide a threat actor with command execution using the web worker’s privileges, creating opportunities to deploy web shells, steal credentials or move further into a network, researchers said.
CrowdStrike has verified an attack exploiting the vulnerabilities “with no authentication, no session, and no vulnerable application code involved,” wrote Amit Serper, principal security researcher at CrowdStrike, in a post.
Researchers at SentinelOne, meanwhile, warned that attackers could steal passwords, tokens and API keys from PHP process memory without executing code—making the activity more challenging to detect with tools focused on malicious code execution.
Broad Exposure
Because the PHP2Shell vulnerabilities impact the underlying PHP engine, the issue has implications across content management systems, business applications and hosting environments, according to researchers.
Researchers at Wiz said that releases dating back to PHP 5.4 are affected by at least one of the vulnerabilities. Its researchers demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla deployments, along with separate attacks that exposed sensitive process memory, they said in a post.
“These platforms illustrate the impact, but the vulnerabilities are in PHP itself,” Wiz researchers wrote. “Even a simple ‘Hello World’ application running on an affected PHP version can be vulnerable.”
Specific exploitation paths have different requirements, according to researchers.
Role Of AI
AI played a major role in discovering the PHP2Shell vulnerabilities and developing working exploits, according to researchers at Wiz.
Developing the exploits required researchers to combine flaws, the researchers said, and AI helped to reduce the effort that was involved in the attacks.
The disclosure of the critical PHP vulnerabilities “marks an AI inflection point. The vulnerable code had been there for more than a decade – what AI changed was the ability to understand the weaknesses and turn them into a working exploit,” the Wiz researchers wrote. “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.”
Patching Urged
PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations are being urged to install the appropriate update or obtain patched packages from their software vendor.
PHP 8.1 and older no longer receive regular updates from the PHP project. Distribution and long-term-support vendors may provide backported fixes, and the PHP security team also supplied minimal source backports for PHP 7.4, 8.0 and 8.1.
Huntress is urging organizations to inventory every PHP installation—including copies bundled into vendor software, hosting control panels and Windows applications—and Internet-facing systems should receive priority, Hammond wrote.
Security teams should also monitor PHP and web server processes for unusual activity, including the launch of shells, scripting interpreters or download tools, according to researchers.
