On October 21st, companies like Wiz engaged in internet security-related businesses announced two security vulnerabilities in the Hypertext Preprocessor (PHP). Due to PHP’s widespread use, around 70% of websites globally are affected. Several countries have urgently shut down some websites for security reasons.
Wiz, Quarkslab, and OpenAI disclosed two significant security vulnerabilities in PHP on October 21st, collectively known as “php2shell,” with vulnerability identification numbers CVE-2026-109618 and CVE-2026-109619. PHP is a widely used general-purpose scripting language that provides technical support for approximately 70% of websites globally, including content management systems such as WordPress, Joomla, Drupal, and platforms like MediaWiki used by Wikipedia.
These vulnerabilities are present in the core PHP code, affecting more than specific website platforms. If attackers exploit these vulnerabilities successfully, they could execute malicious code, steal sensitive data, or tamper with website content on affected servers, posing a significant security risk to global internet services. PHP released patches on October 21st to fix multiple memory security vulnerabilities in the core engine.
According to Wiz, every PHP version released in the past decade has been affected by at least one vulnerability, dating back to PHP 5.4. Attackers can exploit these vulnerabilities remotely, with some vulnerabilities being relatively easy to exploit, hence immediate installation of patches is strongly recommended.
Wiz stated, “These findings can be considered as one of the most severe security vulnerabilities in PHP history, possibly one of the most significant vulnerabilities in software development history. The underlying flaws have existed for decades, but proving that these flaws can be exploited requires a series of extremely complex steps, the difficulty of which is almost beyond what human researchers can achieve in practice.”
“But the use of AI has greatly reduced this barrier, turning a long-standing program flaw into an exploitable attack method.”
These vulnerabilities will affect all web servers running PHP 5.4 or later. When applications process specially designed HTTP traffic, attackers can exploit these vulnerabilities to cause Denial of Service (DoS), Remote Code Execution (RCE), and data exposure issues.
Wiz, an Israeli-founded internet security technology company, focuses on cloud and AI security, helping businesses identify security vulnerabilities and risks in cloud infrastructure, applications, and AI systems, providing risk analysis and protection recommendations. In this PHP vulnerability incident, Wiz used its proprietary AI research tools and other AI models to help discover significant security vulnerabilities in the core of PHP and collaborated with relevant teams to verify patch measures.
Cloudflare also participated in this cross-organizational coordination and protection work. The company stated that it collaborated with the PHP Foundation, OpenAI, Wiz, and other organizations to deploy mitigation measures to protect the entire internet. Since early October 2026, Cloudflare has been developing and deploying Web Application Firewall (WAF) protection rules and completed deployment approximately 9 hours before the vulnerability was officially disclosed.
Cloudflare pointed out that the vulnerability information had leaked before the official release date. Although Cloudflare observed attacks targeting its customers, it successfully deployed multiple mitigation measures for all customers.
“We observe how attackers continuously modify attack payloads to bypass our protection mechanisms by tracking the matching frequency of protection rules and cross-matching this data with rule logic,” Cloudflare stated.
In defense against php2shell, Cloudflare developed the “Full Transaction Detection” feature. This is a new capability of Cloudflare’s Web Application Firewall (WAF) that analyzes requests and response signals from the same HTTP transaction in combination. The system can block them before they reach the requester based on response rules when the server’s response at the source meets specific conditions.
Cloudflare’s cybersecurity analysts continue to monitor attack activities and will update rules in the coming hours to days to address new attack techniques and variants accordingly.
On October 21st, due to the major security vulnerabilities in PHP, some government websites or public services in the United Kingdom, the Netherlands, France, Denmark, Finland, Germany, Belgium, and the Czech Republic were temporarily taken offline.
The National Cyber Security Centre (NCSC) of the Netherlands notified that malicious actors could exploit these vulnerabilities to target any website or web server running PHP. There are currently no signs of actual exploitation of these vulnerabilities, but several websites have been temporarily taken offline as a precautionary measure, including government websites like Overheid.nl, MijnOverheid.nl, and DigiD.
The federal IT service provider ITZBund in Germany temporarily shut down several websites as a preventive measure. The Belgian Ministry of Foreign Affairs temporarily closed its websites following reports of network attacks involving vulnerability exploitation. However, the Belgian Cyber Security Centre stated that no attacks aimed at Belgian websites had been recorded.
Government websites in the Czech Republic were temporarily taken offline at 7 p.m. local time to deploy necessary security updates. Council websites in Edinburgh, Bristol, and Oxford in the United Kingdom were reportedly temporarily offline.
In addition to government agencies, some non-governmental organizations and private companies also temporarily shut down certain websites or services on October 21st due to the significant security vulnerability of “php2shell,” including some technical services of the Wikimedia Foundation, BambooHR providing human resource management services, and internet forums like 4chan and Something Awful.