Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Wikipedia, as a graph / PHP2Shell / Every edit

Every edit of Wikipedia's PHP2Shell article, as what it changed

364 revisions from 2026-10-21 07:50:01 UTC to 2026-10-24 21:41:44 UTC, by 173 named editors and 1 anonymous edits, newest first. Wikipedia shows an edit as a diff of markup; here it is the statements the edit added, removed or reworded, so an edit reads as what it did to the account. 41 revisions were reverts or were reverted. Each entry links to the editor's public Wikipedia page; anonymous editors are never identified.

1. 2026-10-24 21:41:44 UTC · Cicada1010 · -16 bytes mw-rollback minor
   [[WP:CVPI|Interceptor]]: Reverting non-constructive edits by [[Special:Contributions/~2026-56919-99|~2026-56919-99]]
   ~3 reworded

   • PeeonHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host.
   • PeeonHP is a popular programming language that many website and web application codebases are built upon. PHP is a popular programming language that many website and web application codebases are built upon.
   • PeeonHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible.
2. 2026-10-24 21:41:36 UTC · ~2026-56919-99 · +0 bytes mw-reverted
   (no edit summary)
3. 2026-10-24 21:40:44 UTC · ~2026-56919-99 · +16 bytes mw-reverted
   (no edit summary)
   ~3 reworded

   • PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. PeeonHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host.
   • PHP is a popular programming language that many website and web application codebases are built upon. PeeonHP is a popular programming language that many website and web application codebases are built upon.
   • PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. PeeonHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible.
4. 2026-10-24 21:32:14 UTC · Tenshi Hinanawi · +29,801 bytes mw-rollback minor
   Reverted edit by [[Special:Contribs/~2026-56891-34|~2026-56891-34]] ([[User talk:~2026-56891-34|talk]]) to last version by Rtrb
   +39 added, −1 removed

   • PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host.
   • Their existence was publicly announced on 20 October 2026.
   • An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits could be used.
   • PHP is a popular programming language that many website and web application codebases are built upon.
   • The vulnerabilities are estimated to affect nearly 70% of websites.
   • The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud.
   • Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability.
   • Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research.
   • PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible.
   • A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized.
   • The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0.
   • The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12).
   • Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life.
   • Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice.
   • Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems.
   • Volunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versions from the patched source code so that server administrators could automate deployments without compiling PHP themselves.
   • In response to claims on X that unpatched older PHP releases left one-third of the internet permanently vulnerable, Surý stated that there were ways to patch and update the older versions as well.
   • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X (formerly Twitter) by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif.
   • The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released.
   • One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release".
   • Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed.
   • Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure.
   • Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall rules as an attempted stopgap mitigation against the vulnerability.
   • Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day.
   • The potential impacts of the vulnerability were widespread.
   • Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress.<ref name="Collier2026" details="Citing "></ref> PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications.
   • Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry.
   • Some Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyber Security.
   • The US National Security Agency recommended that websites go offline if unable to update immediately.
   • The NCSC released a similar warning, urging organizations to be wary of backdoors.
   • The Japanese National Cybersecurity Office advised PHP users to immediately update their systems.
   • The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws.
   • The Wikimedia Foundation shut down many of their supporting services, and forum sites such as 4chan and Something Awful went offline.
   • Several Japanese websites and applications also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites.
   • The Internet Archive briefly shut down to fix the issue.
   • Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used by about two-thirds of the web at the time.
   • Commentary in The Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment.
   • Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk.
   • Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches.
   • REDIRECT Trump goverment

   +ref https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs +ref https://aws.amazon.com/blogs/security/amazon-threat-intelligence-ident +ref https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/ +ref https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai +ref https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp +ref https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w +ref https://mashable.com/tech/php-vulnerability-websites-offline-affected- +ref https://news-web.php.net/php.announce/509 +ref https://news.ycombinator.com/item?id=50167754 +ref https://scherzer.dev/Blog/20261022-php2shell-timeline +ref https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-P +ref https://thenextweb.com/news/php-foundation-structural-failure-2024-fla +ref https://thephp.foundation/blog/2026/10/21/todays-php-security-release- +ref https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ +ref https://www.afr.com/world/north-america/websites-go-dark-as-ai-discove +ref https://www.bbc.com/news/articles/cmly0lg3w5x2o +ref https://www.bleepingcomputer.com/news/security/php-ships-emergency-pat +ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two +ref https://www.brusselstimes.com/belgium/2371464/major-websites-go-offlin +ref https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-sing +ref https://www.cp24.com/news/canada/2026/10/21/canadian-apps-and-governme +ref https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/ +ref https://www.cve.org/CVERecord?id=CVE-2026-109618 +ref https://www.cve.org/CVERecord?id=CVE-2026-109619 +ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil +ref https://www.itmedia.co.jp/news/article/2610/21/2000002472/ +ref https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php +ref https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release +ref https://www.nytimes.com/2026/09/08/us/politics/calif-ai-worm-wechat-ha +ref https://www.nytimes.com/2026/10/22/technology/what-is-php-vulnerabilit +ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st +ref https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-cons +ref https://www.php.net/archive/2026.php#2026-10-20-1 +ref https://www.php.net/archive/2026.php#2026-10-21-5 +ref https://www.php.net/releases/index.php +ref https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-ma +ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet- +ref https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-compute +ref https://www.theguardian.com/technology/2026/oct/22/what-is-php-compute +ref https://www.wiz.io/blog/php2shell-php-rce +ref https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-u +ref https://x.com/dok2001/status/2112811965735202970

5. 2026-10-24 21:31:13 UTC · ~2026-56891-34 · -29,801 bytes mw-reverted
   [[WP:AES|←]]Redirected page to [[Trump goverment]]
   +1 added, −39 removed

   • REDIRECT Trump goverment
   • PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host.
   • Their existence was publicly announced on 20 October 2026.
   • An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits could be used.
   • PHP is a popular programming language that many website and web application codebases are built upon.
   • The vulnerabilities are estimated to affect nearly 70% of websites.
   • The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud.
   • Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability.
   • Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research.
   • PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible.
   • A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized.
   • The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0.
   • The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12).
   • Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life.
   • Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice.
   • Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems.
   • Volunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versions from the patched source code so that server administrators could automate deployments without compiling PHP themselves.
   • In response to claims on X that unpatched older PHP releases left one-third of the internet permanently vulnerable, Surý stated that there were ways to patch and update the older versions as well.
   • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X (formerly Twitter) by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif.
   • The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released.
   • One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release".
   • Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed.
   • Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure.
   • Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall rules as an attempted stopgap mitigation against the vulnerability.
   • Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day.
   • The potential impacts of the vulnerability were widespread.
   • Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress.<ref name="Collier2026" details="Citing "></ref> PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications.
   • Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry.
   • Some Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyber Security.
   • The US National Security Agency recommended that websites go offline if unable to update immediately.
   • The NCSC released a similar warning, urging organizations to be wary of backdoors.
   • The Japanese National Cybersecurity Office advised PHP users to immediately update their systems.
   • The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws.
   • The Wikimedia Foundation shut down many of their supporting services, and forum sites such as 4chan and Something Awful went offline.
   • Several Japanese websites and applications also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites.
   • The Internet Archive briefly shut down to fix the issue.
   • Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used by about two-thirds of the web at the time.
   • Commentary in The Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment.
   • Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk.
   • Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches.

   −ref https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs −ref https://aws.amazon.com/blogs/security/amazon-threat-intelligence-ident −ref https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/ −ref https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai −ref https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp −ref https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w −ref https://mashable.com/tech/php-vulnerability-websites-offline-affected- −ref https://news-web.php.net/php.announce/509 −ref https://news.ycombinator.com/item?id=50167754 −ref https://scherzer.dev/Blog/20261022-php2shell-timeline −ref https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-P −ref https://thenextweb.com/news/php-foundation-structural-failure-2024-fla −ref https://thephp.foundation/blog/2026/10/21/todays-php-security-release- −ref https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ −ref https://www.afr.com/world/north-america/websites-go-dark-as-ai-discove −ref https://www.bbc.com/news/articles/cmly0lg3w5x2o −ref https://www.bleepingcomputer.com/news/security/php-ships-emergency-pat −ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two −ref https://www.brusselstimes.com/belgium/2371464/major-websites-go-offlin −ref https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-sing −ref https://www.cp24.com/news/canada/2026/10/21/canadian-apps-and-governme −ref https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/ −ref https://www.cve.org/CVERecord?id=CVE-2026-109618 −ref https://www.cve.org/CVERecord?id=CVE-2026-109619 −ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil −ref https://www.itmedia.co.jp/news/article/2610/21/2000002472/ −ref https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php −ref https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release −ref https://www.nytimes.com/2026/09/08/us/politics/calif-ai-worm-wechat-ha −ref https://www.nytimes.com/2026/10/22/technology/what-is-php-vulnerabilit −ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st −ref https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-cons −ref https://www.php.net/archive/2026.php#2026-10-20-1 −ref https://www.php.net/archive/2026.php#2026-10-21-5 −ref https://www.php.net/releases/index.php −ref https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-ma −ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet- −ref https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-compute −ref https://www.theguardian.com/technology/2026/oct/22/what-is-php-compute −ref https://www.wiz.io/blog/php2shell-php-rce −ref https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-u −ref https://x.com/dok2001/status/2112811965735202970

6. 2026-10-24 21:19:40 UTC · Rtrb · -4 bytes mw-undo
   Undid revision [[Special:Diff/1381795121|1381795121]] by [[Special:Contributions/~2026-56929-69|~2026-56929-69]] ([[User talk:~2026-56929-69|talk]])
7. 2026-10-24 21:16:52 UTC · ~2026-56929-69 · +4 bytes mw-reverted
   (no edit summary)
8. 2026-10-24 21:06:04 UTC · Rtrb · +18 bytes
   /* See also */ adjusted link text
9. 2026-10-24 20:25:05 UTC · ~2026-56896-64 · +19 bytes
   (no edit summary)
   +1 added, ~1 reworded

   • The vulnerabilities are estimated to affect nearly 70% of websites.
   • PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of websites. PHP is a popular programming language that many website and web application codebases are built upon.
10. 2026-10-24 20:22:42 UTC · ~2026-56896-64 · +35 bytes
    memory safety
    ~1 reworded

    • PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host.
11. 2026-10-24 19:52:09 UTC · Sleeps-Darkly · +518 bytes
    (no edit summary)
    +2 added

    • Volunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versions from the patched source code so that server administrators could automate deployments without compiling PHP themselves.
    • In response to claims on X that unpatched older PHP releases left one-third of the internet permanently vulnerable, Surý stated that there were ways to patch and update the older versions as well.
12. 2026-10-24 14:37:36 UTC · Pigsonthewing · -6 bytes
    /* */ not just commerce
    ~1 reworded

    • PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of the commercial world wide web. PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of websites.
13. 2026-10-24 13:52:49 UTC · PhotographyEdits · -2 bytes
    /* See also */ remove newline
14. 2026-10-24 13:52:37 UTC · PhotographyEdits · +41 bytes
    add link
15. 2026-10-24 13:02:31 UTC · ~2026-56643-37 · +0 bytes
    (no edit summary)
16. 2026-10-24 12:44:18 UTC · Surtsicna · -14 bytes
    simplifying links per [[WP:NOPIPE]]
17. 2026-10-24 09:04:05 UTC · Brandmeister · -5 bytes
    /* */ smoother flow
    ~1 reworded

    • PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host.
18. 2026-10-24 04:16:10 UTC · Harizotoh9 · +0 bytes
    (no edit summary)
19. 2026-10-24 03:58:42 UTC · SoyUnEditorRandom · +29 bytes
    (no edit summary)
20. 2026-10-24 03:13:41 UTC · Doc James · +11 bytes
    /* Impact */ nice to be able to read it
21. 2026-10-24 02:38:48 UTC · Another Believer · +5,291 bytes
    Rescuing 28 sources and tagging 0 as dead. #IABot (v2.0.9.6)
22. 2026-10-24 01:44:04 UTC · PhageRules1 · -128 bytes
    Undid revision 1381654262; claim not substantiated by citations given.
    −1 removed

    • Some Japanese users compared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!.
23. 2026-10-24 01:37:29 UTC · Northern Moonlight · +19 bytes
    /* Patches */
    ~1 reworded

    • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X (formerly Twitter) by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif.
24. 2026-10-24 01:36:55 UTC · Northern Moonlight · +38 bytes
    dmy date
25. 2026-10-24 01:23:58 UTC · Citation bot · +2 bytes
    Altered title. Add: authors 1-1. Removed parameters. Some additions/deletions were parameter name changes. | [[:en:WP:UCB|Use this bot]]. [[:en:WP:DBUG|Report bugs]]. | Suggested by RafaelTLS | #UCB_toolbar
26. 2026-10-24 01:17:46 UTC · Thomasfan1916 · +0 bytes
    (no edit summary)
27. 2026-10-23 23:35:56 UTC · Dentsinhere43 · +0 bytes
    improve refs

    −ref https://jackalsyn.com/posts/php-up-2026.html

28. 2026-10-23 23:07:26 UTC · Vitorperrut555 · -1 bytes
    Cleaning up syntax using [[:en:User:Zackmann08/scripts/indent|indent.js]]
29. 2026-10-23 22:59:01 UTC · Sinus Pi · +686 bytes
    /* Patches */ backport information
    ~1 reworded

    • Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems.

    +ref https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/ +ref https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-P

30. 2026-10-23 22:52:25 UTC · Iridescence · +0 bytes minor
    /* Impact */ fix typos
    ~1 reworded

    • Some japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!. Some Japanese users compared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!.
31. 2026-10-23 22:43:04 UTC · ~2026-56065-30 · +1 bytes
    /* Impact */
    ~1 reworded

    • Some japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game. Some japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!.
32. 2026-10-23 22:42:22 UTC · ~2026-56065-30 · +2 bytes
    /* Impact */
33. 2026-10-23 22:41:48 UTC · ~2026-56065-30 · +125 bytes
    /* Impact */
    +1 added

    • Some japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game.
34. 2026-10-23 22:11:35 UTC · OrbitalVoid49 · -21 bytes
    /* See also */ [[MOS:NOTSEEAGAIN]]
35. 2026-10-23 19:57:02 UTC · BarrelProof · +14 bytes
    excess blank space
36. 2026-10-23 19:49:34 UTC · ~2026-55979-03 · +4 bytes
    wlnk
37. 2026-10-23 19:13:49 UTC · Freedom4U · +240 bytes
    /* Impact */ precision and re-organization of first sentence
    +2 added, −2 removed

    • The potential impacts of the vulnerability were widespread.
    • Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress.<ref name="Collier2026" details="Citing "></ref> PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications.
    • Approximately 69% of websites worldwide use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread.
    • PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications.

    −ref https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-upd

38. 2026-10-23 17:22:04 UTC · DaSupremo · +0 bytes minor
    (no edit summary)
39. 2026-10-23 16:01:22 UTC · Achmad Rachmani · -13 bytes
    /* */ Alter: title, website.
40. 2026-10-23 14:43:46 UTC · ClueBot NG · -88 bytes mw-rollback minor
    Reverting possible vandalism by [[Special:Contribs/~2026-56713-33|~2026-56713-33]] to version by Qzd. [[WP:CBFP|Report False Positive?]] Thanks, [[WP:CBNG|ClueBot NG]]. (4563195) (Bot)
    −1 removed

    • DONT USE THIS WESTITE PEOPLE EDIT THESE ARTICALS UNRELIEABLE thank you from a six grader
41. 2026-10-23 14:43:41 UTC · ~2026-56713-33 · +88 bytes mw-reverted
    (no edit summary)
    +1 added

    • DONT USE THIS WESTITE PEOPLE EDIT THESE ARTICALS UNRELIEABLE thank you from a six grader
42. 2026-10-23 14:41:47 UTC · Qzd · -36 bytes mw-rollback minor
    [[WP:CVPI|Interceptor]]: Reverting non-constructive edits by [[Special:Contributions/~2026-56713-33|~2026-56713-33]]
    −2 removed, ~1 reworded

    • PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-
    • i was there when it happen
    • 2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host.
43. 2026-10-23 14:41:23 UTC · ~2026-56713-33 · +36 bytes mw-reverted
    (no edit summary)
    +2 added, ~1 reworded

    • PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-
    • i was there when it happen
    • PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host. 2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host.
44. 2026-10-23 14:22:43 UTC · The Grid · -9 bytes
    ce
    ~1 reworded

    • Czech volunteer Ondřej Surý was credited with playing a crucial role automating the necessary patches. Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches.
45. 2026-10-23 14:04:19 UTC · Thatsmemira · +8 bytes minor
    /* Impact */ grammar
    ~1 reworded

    • The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. The Wikimedia Foundation shut down many of their supporting services, and forum sites such as 4chan and Something Awful went offline.
46. 2026-10-23 13:44:29 UTC · Masem · +1 bytes
    /* Discovery */ flip para
    ~1 reworded

    • PHP versions as early as 5.4 (released in 2012) are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible.
47. 2026-10-23 13:41:34 UTC · Masem · +364 bytes
    /* */
    +1 added, ~2 reworded

    • PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of the commercial world wide web.
    • PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host.
    • An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits could be used.
48. 2026-10-23 13:11:57 UTC · Victor Matheus Amaral · +46 bytes
    (no edit summary)
    ~2 reworded

    • Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall rules as an attempted stopgap mitigation against the vulnerability.
    • Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency (CISA) said it had not observed exploitation as of the same day. Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day.
49. 2026-10-23 10:42:43 UTC · Brandmeister · +20 bytes
    /* Patches */ wlinks
50. 2026-10-23 10:31:46 UTC · 四特朗普通话 · +9 bytes minor
    (no edit summary)
51. 2026-10-23 10:10:06 UTC · Brandmeister · +19 bytes
    brief clarity
    ~2 reworded

    • PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE).
    • Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread. Approximately 69% of websites worldwide use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread.
52. 2026-10-23 09:54:36 UTC · Guninvalid · -98 bytes
    /* See also */ just use the anl template instead
53. 2026-10-23 09:49:31 UTC · DragonFury · +4 bytes minor
    /* See also */
54. 2026-10-23 09:23:44 UTC · Salmon Of Ignorance · +86 bytes
    see also - heartbleed
55. 2026-10-23 09:22:19 UTC · Salmon Of Ignorance · +17 bytes
    (no edit summary)
    ~1 reworded

    • Several Japanese websites also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. Several Japanese websites and applications also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites.
56. 2026-10-23 09:21:48 UTC · Salmon Of Ignorance · -5 bytes
    More correct language
    ~1 reworded

    • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. Several Japanese websites also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites.
57. 2026-10-23 08:34:25 UTC · Jcuhfehl · -133 bytes mw-undo
    Undid revision [[Special:Diff/1381548266|1381548266]] by [[Special:Contributions/Stormx007|Stormx007]] ([[User talk:Stormx007|talk]]) promotional link
58. 2026-10-23 08:26:46 UTC · Jcuhfehl · -395 bytes mw-manual-revert
    WP:ELNO
    −2 removed

    • To help administrators verify the impact, several vendors and devs released free tools during the embargo and after the embargo.
    • These included Pentest-Tools.com, Aikido, Trend Micro, Astra Security and many others.
59. 2026-10-23 07:19:28 UTC · ~2026-56509-37 · +96 bytes mw-reverted
    Updated the list of testing tools
    ~1 reworded

    • These included Aikido, Trend Micro, Astra Security and many others. These included Pentest-Tools.com, Aikido, Trend Micro, Astra Security and many others.
60. 2026-10-23 07:06:46 UTC · ~2026-56562-46 · +299 bytes mw-reverted
    Just added about the free tools made by some vendors to help people detect their exposure
    +2 added

    • To help administrators verify the impact, several vendors and devs released free tools during the embargo and after the embargo.
    • These included Aikido, Trend Micro, Astra Security and many others.
61. 2026-10-23 06:59:02 UTC · Stormx007 · +133 bytes mw-reverted minor
    Added link to a testing tool
62. 2026-10-23 06:27:18 UTC · ~2026-56643-37 · +0 bytes
    (no edit summary)
63. 2026-10-23 06:18:48 UTC · Daddynnoob · -1 bytes
    /* Discovery */
    ~1 reworded

    • The Cyber Security Agency of Singapore has also urged organizations in Singapore to fix the security flaws. The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws.
64. 2026-10-23 06:17:08 UTC · Daddynnoob · -139 bytes
    Link edits
    ~5 reworded

    • Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry.
    • The UK National Cyber Security Centre released a similar warning, urging organizations to be wary of backdoors. The NCSC released a similar warning, urging organizations to be wary of backdoors.
    • The Cyber Security Agency of Singapore has also urged organisations in Singapore to fix the security flaws. The Cyber Security Agency of Singapore has also urged organizations in Singapore to fix the security flaws.
    • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites.
    • Volunteer Ondřej Surý of the Czech Republic was credited with playing a crucial role automating the necessary patches. Czech volunteer Ondřej Surý was credited with playing a crucial role automating the necessary patches.
65. 2026-10-23 05:26:57 UTC · Milk 'n' Thyme · +373 bytes
    (no edit summary)
66. 2026-10-23 05:11:50 UTC · Yeeno · +489 bytes
    /* Impact */ Add Canadian gov't
    +1 added

    • Some Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyber Security.

    +ref https://www.cp24.com/news/canada/2026/10/21/canadian-apps-and-governme

67. 2026-10-23 04:26:09 UTC · DRWiki1102 · +0 bytes
    Resolved CS1 error
68. 2026-10-23 03:47:03 UTC · Lemoncaked · +9 bytes minor
    /* Analysis */ felt that it should be clarified what library was affected
    ~1 reworded

    • Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used by about two-thirds of the web at the time.
69. 2026-10-23 03:44:56 UTC · FromCzech · +8 bytes minor
    /* Analysis */
70. 2026-10-23 03:43:38 UTC · FromCzech · +81 bytes
    /* Analysis */ [[MOS:GEO]], ref format
    ~1 reworded

    • Volunteer Ondřej Surý of Czechia was credited with playing a crucial role automating the necessary patches. Volunteer Ondřej Surý of the Czech Republic was credited with playing a crucial role automating the necessary patches.

    +ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet- −ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-

71. 2026-10-23 03:41:20 UTC · ZKang123 · +0 bytes
    /* Impact */
72. 2026-10-23 03:40:40 UTC · ZKang123 · +690 bytes
    /* Impact */ Added Singapore
    +1 added

    • The Cyber Security Agency of Singapore has also urged organisations in Singapore to fix the security flaws.

    +ref https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-sing +ref https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/

73. 2026-10-23 03:04:00 UTC · Kencf0618 · +331 bytes
    /* Analysis */ Vital role of Ondřej Surý
    +1 added

    • Volunteer Ondřej Surý of Czechia was credited with playing a crucial role automating the necessary patches.

    +ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-

74. 2026-10-23 02:57:35 UTC · Johnson524 · +21 bytes
    Added Commons Category
75. 2026-10-23 02:41:24 UTC · Ca · -485 bytes
    /* Patches */ rm unreliable source

    −ref https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php

76. 2026-10-23 01:31:35 UTC · 2k7x · +25 bytes
    {{start date and age}}
77. 2026-10-23 01:23:08 UTC · XCBRO172 · +1 bytes minor
    /* Patches */ ce
    ~1 reworded

    • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums,in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif.
78. 2026-10-23 00:54:42 UTC · Darth Stabro · +189 bytes minor
    [[Wikipedia:MOSNUMscript|script]]-assisted date audit and style fixes per [[MOS:NUM]]
79. 2026-10-23 00:54:27 UTC · Darth Stabro · -1 bytes minor
    rm extra space
80. 2026-10-23 00:04:07 UTC · Astrohare · +2 bytes minor
    Calif discovered the vulnerability on August 1st 2026 (https://calif.io/php2shell/)
81. 2026-10-22 23:43:29 UTC · ~2026-56635-78 · +186 bytes
    /* Patches */ address a missing citation for the timeline

    +ref https://scherzer.dev/Blog/20261022-php2shell-timeline

82. 2026-10-22 22:26:46 UTC · ~2026-56634-11 · +33 bytes
    /* See also */ don't assume they are related
83. 2026-10-22 22:11:29 UTC · Dialh · +32 bytes
    /* Impact */
84. 2026-10-22 21:49:43 UTC · Paprikaiser · -19 bytes
    /* Patches */ Fixed lint error
    ~1 reworded

    • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums,in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif.
85. 2026-10-22 20:27:24 UTC · Ahecht · -692 bytes
    Remove paragraph sourced to social media
    −1 removed

    • An analysis by company-data firm Veridion of web technology detections mapped affected PHP version strings to the companies operating the websites, identifying about 7.07 million companies running an affected version, most of them with fewer than 50 employees; a further 21.9 million companies used PHP without exposing a version and were not counted.

    −ref https://www.linkedin.com/pulse/php2shell-we-traced-7-million-potential

86. 2026-10-22 20:26:06 UTC · Grimes2 · -5 bytes minor
    Replaced [[Wikipedia:VisualEditor/Named references|VE ref names]] using [[User:Nardog/RefRenamer|RefRenamer]]
87. 2026-10-22 20:24:44 UTC · Ahecht · -49 bytes
    I don't think this needs to be it's own section at this point
    −1 removed, ~1 reworded

    • The New York Times covered the event on 22 October.
    • They said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk. Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk.
88. 2026-10-22 18:42:03 UTC · RoySmith · +536 bytes
    /* Analysis */ NY Times coverage
    +2 added

    • The New York Times covered the event on 22 October.
    • They said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk.

    +ref https://www.nytimes.com/2026/10/22/technology/what-is-php-vulnerabilit

89. 2026-10-22 18:25:11 UTC · Ahecht · +1,090 bytes
    The references were broken because a closing quote mark was removed, not because of the details. Restore quotes for subscription-locked article per [[WP:FQ]] since "the source is not easily accessible"
90. 2026-10-22 18:16:57 UTC · Ahecht · +0 bytes
    fix reference name
91. 2026-10-22 18:15:11 UTC · Ahecht · +0 bytes
    /* Impact */ Let's not take up 80% of the width of the article
92. 2026-10-22 17:41:03 UTC · Nosferattus · -29 bytes
    Removing commercial spam trying to sell security services related to PHP2Shell
93. 2026-10-22 16:59:55 UTC · Saratoga18 · +4 bytes
    /* Analysis */ sourced to same Veridion citation
94. 2026-10-22 16:58:39 UTC · Quindraco · +0 bytes
    /* Discovery */
    ~1 reworded

    • The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026; and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud.
95. 2026-10-22 16:28:54 UTC · Ataaras · +119 bytes minor
    Image added.
96. 2026-10-22 16:13:35 UTC · Maxeto0910 · -5 bytes
    /* */ unnecessary in infobox
97. 2026-10-22 16:13:20 UTC · Maxeto0910 · -1 bytes
    /* */ no sentence
98. 2026-10-22 15:42:37 UTC · Phoenix · +37 bytes
    citation needed
99. 2026-10-22 15:14:00 UTC · Kencf0618 · +4 bytes
    /* Impact */ Prosody & encyclopedic tone
    ~1 reworded

    • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous online commerce sites.
100. 2026-10-22 14:56:24 UTC · Marnanel · +228 bytes
     /* top */link CVEs

     +ref https://www.cve.org/CVERecord?id=CVE-2026-109618 +ref https://www.cve.org/CVERecord?id=CVE-2026-109619

101. 2026-10-22 14:53:23 UTC · 4Seasons4 · +41 bytes minor
     Links added
102. 2026-10-22 13:49:29 UTC · ~2026-56519-53 · +1 bytes
     /* */
103. 2026-10-22 13:30:28 UTC · TheRaknok · +4 bytes minor
     Fixed grammar, italic
     ~1 reworded

     • Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time.
104. 2026-10-22 12:18:25 UTC · BwDraco · +2 bytes minor
     Wording
     ~1 reworded

     • Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2 thirds of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time.
105. 2026-10-22 11:35:46 UTC · Celjski Grad · -10 bytes mw-rollback minor
     [[WP:CVPI|Interceptor]]: Reverting non-constructive edits by [[Special:Contributions/~2026-56473-52|~2026-56473-52]]
     ~1 reworded

     • An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. hi thomas An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day.
106. 2026-10-22 11:33:21 UTC · ~2026-56473-52 · +10 bytes mw-reverted
     (no edit summary)
     ~1 reworded

     • An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. hi thomas
107. 2026-10-22 11:31:43 UTC · Pigsonthewing · -3 bytes
     /* */ ce
     ~1 reworded

     • PHP2Shell is a set of two high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE).
108. 2026-10-22 11:29:49 UTC · SoyUnEditorRandom · +5 bytes mw-undo
     Undid revision [[Special:Diff/1381424661|1381424661]] by [[Special:Contributions/~2026-56484-56|~2026-56484-56]] ([[User talk:~2026-56484-56|talk]])
     ~1 reworded

     • Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2/3 of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2 thirds of the web at the time.
109. 2026-10-22 11:23:53 UTC · ~2026-56484-56 · -5 bytes mw-reverted
     /* Analysis */ spelling
     ~1 reworded

     • Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2 thirds of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2/3 of the web at the time.
110. 2026-10-22 11:12:29 UTC · Rich Smith · -437 bytes
     (no edit summary)
111. 2026-10-22 11:11:34 UTC · SoyUnEditorRandom · -27 bytes
     /* Discovery */
112. 2026-10-22 11:10:08 UTC · Rich Smith · -256 bytes
     /* Discovery */ Fix ref, maybe
113. 2026-10-22 10:56:44 UTC · Awtistik Dev · +637 bytes minor
     Added company-level exposure figures; I work at Veridion (COI).
     +1 added

     • An analysis by company-data firm Veridion of web technology detections mapped affected PHP version strings to the companies operating the websites, identifying about 7.07 million companies running an affected version, most of them with fewer than 50 employees; a further 21.9 million companies used PHP without exposing a version and were not counted.

     +ref https://www.linkedin.com/pulse/php2shell-we-traced-7-million-potential

114. 2026-10-22 10:06:34 UTC · Dare2Leap · +2 bytes minor
     Improve formatting
115. 2026-10-22 09:49:33 UTC · ~2026-56578-19 · +342 bytes
     /* Patches */ Add HN post via Wayback Machine link

     +ref https://news.ycombinator.com/item?id=50167754

116. 2026-10-22 09:19:12 UTC · 98uwd · +75 bytes minor
     Add links, format days DMY as per the note
     −1 removed, ~2 reworded

     • 17, 2026, in MadPot telemetry, four days before public disclosure.
     • Both vulnerabilities were published through GitHub security advisories on 21 October at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter.
     • Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure.
117. 2026-10-22 09:15:04 UTC · Osarius · +9 bytes minor
     clean up
118. 2026-10-22 08:29:17 UTC · Salmon Of Ignorance · +165 bytes
     added release date to 5.4
     ~1 reworded

     • PHP versions as early as 5.4 are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. PHP versions as early as 5.4 (released in 2012) are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible.

     +ref https://www.php.net/releases/index.php

119. 2026-10-22 08:17:16 UTC · ~chenniest · -9 bytes minor
     (no edit summary)
120. 2026-10-22 08:13:42 UTC · ~chenniest · -19 bytes minor
     (no edit summary)
121. 2026-10-22 08:12:06 UTC · ~2026-56496-69 · -7 bytes mw-manual-revert
     done
122. 2026-10-22 08:11:28 UTC · ~2026-56496-69 · +7 bytes mw-reverted
     sd
123. 2026-10-22 08:03:55 UTC · ~2026-56733-82 · +0 bytes
     PHP 8.4 instead of PHP 8.8
     ~1 reworded

     • An emergency patch for versions 8.2, 8.3, 8.8 and 8.5 and details about the vulnerabilities were released the following day. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day.
124. 2026-10-22 07:34:30 UTC · ~2026-56504-79 · -1 bytes
     (no edit summary)
     ~1 reworded

     • Commentary in the Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, receieved "billions" in investment. Commentary in the Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment.
125. 2026-10-22 07:27:44 UTC · Martsniez · +35 bytes
     Important to note that versions prior to 8 are not patched.
     ~1 reworded

     • An emergency patch and details about the vulnerabilities were released the following day. An emergency patch for versions 8.2, 8.3, 8.8 and 8.5 and details about the vulnerabilities were released the following day.
126. 2026-10-22 07:18:45 UTC · 2kbfloppadisk · +4 bytes minor
     /* Analysis */ wl
127. 2026-10-22 07:09:18 UTC · 2kbfloppadisk · +28 bytes minor
     /* Analysis */ cleanup
     ~1 reworded

     • Commentary in the Guardian also noted that the PHP Foundation only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which were credited with helping discover the vulnerability, receieved "billions" in investment. Commentary in the Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, receieved "billions" in investment.
128. 2026-10-22 07:07:45 UTC · 2kbfloppadisk · +1,100 bytes
     add analysis section
     +2 added

     • Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2 thirds of the web at the time.
     • Commentary in the Guardian also noted that the PHP Foundation only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which were credited with helping discover the vulnerability, receieved "billions" in investment.

     +ref https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai +ref https://www.theguardian.com/technology/2026/oct/22/what-is-php-compute

129. 2026-10-22 07:05:02 UTC · Novem Linguae · +1 bytes
     test
130. 2026-10-22 07:03:10 UTC · Novem Linguae · +1 bytes
     test
131. 2026-10-22 07:00:59 UTC · Novem Linguae · -3 bytes
     ce
     ~1 reworded

     • An emergency patch and details about the vulnerabilities were released on the following day. An emergency patch and details about the vulnerabilities were released the following day.
132. 2026-10-22 07:00:40 UTC · Novem Linguae · -56 bytes
     ce
     ~1 reworded

     • PHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, know under Common Vulnerabilities and Exposures IDs CVE-2026-109618 and CVE-2026-109619, that allow remote code execution (RCE). PHP2Shell is a set of two high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE).
133. 2026-10-22 06:57:01 UTC · ~2026-56223-90 · -1 bytes
     grammafr fix
     ~1 reworded

     • PHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, known under Common Vulnerabilities and Exposures IDs CVE-2026-109618 and CVE-2026-109619, that allow remote code execution (RCE). PHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, know under Common Vulnerabilities and Exposures IDs CVE-2026-109618 and CVE-2026-109619, that allow remote code execution (RCE).
134. 2026-10-22 06:39:26 UTC · ~2026-56496-69 · -10 bytes mw-manual-revert
     (no edit summary)
135. 2026-10-22 06:38:01 UTC · ~2026-56496-69 · +10 bytes mw-reverted
     sweet32 too
136. 2026-10-22 05:22:09 UTC · Yedaman54 · +79 bytes
     (no edit summary)
137. 2026-10-22 05:07:02 UTC · ShadowLancer · -51 bytes
     /* Discovery */ clean up language, clarify finer points from the listed sources
     +1 added, −1 removed

     • PHP versions as early as 5.4 are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible.
     • PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time because it was not thought that an exploit—software that actually uses the security hole to gain access—would be feasible.
138. 2026-10-22 04:46:48 UTC · TAKAHASHI Shuuji · +2 bytes minor
     /* Impact */ for better readability, split single large paragraph into three paragraphs (about php ecosystem, about governmental agency, and about temporary shut down of websites)
139. 2026-10-22 04:42:41 UTC · TAKAHASHI Shuuji · -5 bytes minor
     remove an extra space. remove a duplicated wikilink
140. 2026-10-22 04:39:16 UTC · Merlin04 · +71 bytes
     /* Discovery */ Add Wiz corporate structure information
     ~1 reworded

     • The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026; and the Israeli–American cloud security company Wiz, Inc. The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026; and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud.
141. 2026-10-22 04:35:53 UTC · Merlin04 · +121 bytes
     /* Discovery */ ce, clarify Calif researcher LLM use
     +1 added, ~1 reworded

     • Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability.
     • The two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli–American cloud security company Wiz, Inc. The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026; and the Israeli–American cloud security company Wiz, Inc.
142. 2026-10-22 04:32:53 UTC · TAKAHASHI Shuuji · +70 bytes
     /* External links */ update php announcement link to latest one. add wiz announcement too. avoid deprecated url template usage (ref. [[Template:URL#Parm2]])
143. 2026-10-22 04:19:58 UTC · Merlin04 · +67 bytes
     /* Discovery */ Clarify Wiz AI use
     +1 added, −1 removed

     • Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research.
     • To help discover the bug, Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas were used.
144. 2026-10-22 04:09:07 UTC · Merlin04 · -4 bytes
     /* Discovery */ ce
     +1 added, −1 removed

     • A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized.
     • A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and inasmuch as a specific exploit had not yet been discovered, the work to resolve it was not completed.
145. 2026-10-22 02:57:15 UTC · Kencf0618 · +6 bytes
     /* Discovery */ Prosody and nuance
     ~1 reworded

     • A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and since a specific exploit had not yet been discovered, the work to resolve it was not completed. A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and inasmuch as a specific exploit had not yet been discovered, the work to resolve it was not completed.
146. 2026-10-22 02:55:57 UTC · Kencf0618 · +7 bytes
     /* Discovery */ Prosody and nuance; WP:MDASH works better than parentheses here
     ~1 reworded

     • PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit (software that actually uses the security hole to gain access) would be feasible. PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time because it was not thought that an exploit—software that actually uses the security hole to gain access—would be feasible.
147. 2026-10-22 02:21:51 UTC · ~2026-56527-79 · +512 bytes
     /* Patches */ Important earlier wild date reported by AWS
     +2 added

     • Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct.
     • 17, 2026, in MadPot telemetry, four days before public disclosure.

     +ref https://aws.amazon.com/blogs/security/amazon-threat-intelligence-ident

148. 2026-10-22 02:18:10 UTC · Ahecht · -126 bytes
     Undid revision [[Special:Diff/1381382832|1381382832]] by [[Special:Contributions/~2026-56060-32|~2026-56060-32]] ([[User talk:~2026-56060-32|talk]]) No strong ties to British English.
     ~1 reworded

     • Parts of the Japanese internet also went offline, including Cygames franchises such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, fansites, government agencies, and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites.
149. 2026-10-22 02:17:51 UTC · Ca · -169 bytes
     (no edit summary)
150. 2026-10-22 02:13:57 UTC · ~2026-56060-32 · +126 bytes
     (no edit summary)
     ~1 reworded

     • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites. Parts of the Japanese internet also went offline, including Cygames franchises such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, fansites, government agencies, and many online commerce sites.
151. 2026-10-22 02:07:52 UTC · Ahecht · +42 bytes
     Calif is involved in php2shell.com as well, no need to list them separately in the infobox.
152. 2026-10-22 01:48:39 UTC · Thuyhung2112 · -517 bytes
     remove duplicated citation
153. 2026-10-22 01:39:54 UTC · Mr. Lechkar · +232 bytes
     Tagged [[WP:DUPREF|duplicate citations]] using [[User:Polygnotus/DuplicateReferences|DuplicateReferences]]
154. 2026-10-22 01:10:12 UTC · ~2026-56346-31 · -3 bytes
     reformat the website lists
155. 2026-10-22 01:07:30 UTC · ~2026-56346-31 · +38 bytes
     Attribute to Calif who was the first team that found php2shell, and link to their website.
156. 2026-10-22 00:36:14 UTC · Dare2Leap · -7 bytes minor
     /* Impact */ Fix author name
157. 2026-10-22 00:35:22 UTC · Dare2Leap · -114 bytes
     /* Discovery */ Remove non-confirming citation
158. 2026-10-22 00:34:24 UTC · Dare2Leap · +599 bytes
     /* Discovery */ Add method of discovery
     +1 added

     • To help discover the bug, Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas were used.
159. 2026-10-22 00:33:02 UTC · Fgnievinski · +25 bytes
     /* Patches */
160. 2026-10-22 00:30:16 UTC · AlexChillOut · +85 bytes
     the sources don't mention Wiz at all (unless I missed it somehow), and I can't seem to find anything other than them buying the domain.
161. 2026-10-22 00:23:50 UTC · Panamitsu · -4 bytes minor
     [[MOS:OVERLINK]]
162. 2026-10-22 00:23:11 UTC · Panamitsu · -4 bytes minor
     [[MOS:OVERLINK]]
163. 2026-10-22 00:21:42 UTC · Dare2Leap · +440 bytes
     /* Impact */ Add Internet Archive
     +1 added

     • The Internet Archive briefly shut down to fix the issue.

     +ref https://www.afr.com/world/north-america/websites-go-dark-as-ai-discove

164. 2026-10-22 00:17:24 UTC · Gabldotink · -5 bytes minor
     /* top */[[MOS:CURLY]]
165. 2026-10-22 00:12:34 UTC · Dare2Leap · +0 bytes
     /* Patches */ Prioritize secondary citations
166. 2026-10-22 00:09:39 UTC · Dare2Leap · -236 bytes mw-undo
     Undid revision [[Special:Diff/1381372239|1381372239]] by [[Special:Contributions/Dare2Leap|Dare2Leap]] ([[User talk:Dare2Leap|talk]]) Only supports part of the sentence
167. 2026-10-22 00:08:56 UTC · Dare2Leap · +236 bytes mw-reverted
     /* Patches */ Add citation
168. 2026-10-21 23:50:59 UTC · Ahecht · -482 bytes
     use non-primary source
169. 2026-10-21 23:13:40 UTC · ~2026-56359-71 · -292 bytes
     (no edit summary)

     −ref https://www.thedigitalforensics.com/infosec/php2shell-ai-didnt-find-th

170. 2026-10-21 23:13:10 UTC · ~2026-55697-37 · +3 bytes
     Fixed link
171. 2026-10-21 23:12:10 UTC · ~2026-55697-37 · +16 bytes
     Fixed link

     −ref https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two

172. 2026-10-21 23:08:54 UTC · ~2026-56359-71 · +292 bytes
     (no edit summary)

     +ref https://www.thedigitalforensics.com/infosec/php2shell-ai-didnt-find-th

173. 2026-10-21 23:06:21 UTC · Novem Linguae · -47 bytes
     /* See also */ no rogue agents were involved in discovering this
174. 2026-10-21 23:05:29 UTC · Novem Linguae · +1 bytes
     /* Impact */ past tense
     ~1 reworded

     • Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts are widespread. Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread.
175. 2026-10-21 23:04:36 UTC · Novem Linguae · -197 bytes
     combine duplicate references
176. 2026-10-21 22:50:16 UTC · Fgnievinski · +39 bytes
     (no edit summary)
     +1 added, −1 removed

     • PHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, known under Common Vulnerabilities and Exposures IDs CVE-2026-109618 and CVE-2026-109619, that allow remote code execution (RCE).
     • CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two high-impact vulnerabilities in PHP versions 5.4–8.5 that allow remote code execution (RCE).
177. 2026-10-21 22:35:27 UTC · ~2026-56182-50 · +47 bytes
     (no edit summary)
178. 2026-10-21 22:13:34 UTC · Regulov · +2 bytes minor
     /* Discovery */
     ~1 reworded

     • The two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. The two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli–American cloud security company Wiz, Inc.
179. 2026-10-21 21:50:16 UTC · Padgriffin · +97 bytes mw-undo
     Undid revision [[Special:Diff/1381357570|1381357570]] by [[Special:Contributions/Spinarak|Spinarak]] ([[User talk:Spinarak|talk]]) [[WP:BOLDly]] reverting, given that the examples are things that you would, in all likelihood, not associate with PHP, and go beyond the “government websites” examples we have in the rest of the section
     ~1 reworded

     • Parts of the Japanese internet also went offline, including videogames and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites.
180. 2026-10-21 21:44:35 UTC · Spinarak · -97 bytes mw-reverted
     /* Impact */ more concise: not necessary to give examples of Japanese videogames
     ~1 reworded

     • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites. Parts of the Japanese internet also went offline, including videogames and many online commerce sites.
181. 2026-10-21 21:30:42 UTC · Ahecht · +25 bytes
     clarify that PHP doesn't "host" cPanel, it's just bundled with it
     ~1 reworded

     • PHP is also bundled with vendor appliances, hosting control panels such as cPanel and Plesk, and some Windows applications. PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications.
182. 2026-10-21 21:26:57 UTC · Ahecht · -43 bytes
     /* Discovery */ not needed since a secondary source is also supplied here
183. 2026-10-21 21:26:23 UTC · Ahecht · +43 bytes
     /* Discovery */ This source doesn't support the "decades" claim, just the 2024 one.
184. 2026-10-21 21:02:39 UTC · HouseBlaster · -1 bytes
     /* Impact */ fix space
     +1 added, −1 removed, ~1 reworded

     • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites.
     • Re:Dive, and many online commerce sites.
     • The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline.
185. 2026-10-21 20:59:41 UTC · Suntooooth · -243 bytes
     /* Patches */ Removed "at this point in time" sentence that 1. was referenced to a primary source, and 2. would be outdated quickly
     −1 removed

     • At this point in time Amazon (AWS) have not released a patch for AL2023.

     −ref https://explore.alas.aws.amazon.com/CVE-2026-109618.html

186. 2026-10-21 20:44:14 UTC · मल्ल · -540 bytes
     /* Impact */ non-primary sourcing
     +1 added, −1 removed, ~1 reworded

     • Re:Dive, and many online commerce sites.
     • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasy XIV, and many online commerce sites.
     • The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect!

     +ref https://mashable.com/tech/php-vulnerability-websites-offline-affected- −ref https://diff.wikimedia.org/2026/10/21/impact-of-php-vulnerabilities-on −ref https://na.finalfantasyxiv.com/lodestone/news/detail/682d63eac6bb6c380 −ref https://umamusume.jp/news/detail?id=3523

187. 2026-10-21 20:41:56 UTC · 2kbfloppadisk · -52 bytes minor
     /* Impact */ overlinked
188. 2026-10-21 20:40:13 UTC · 2kbfloppadisk · +546 bytes
     /* Impact */ Expanding article
     +1 added

     • The UK National Cyber Security Centre released a similar warning, urging organizations to be wary of backdoors.

     +ref https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-compute

189. 2026-10-21 20:31:39 UTC · ~2026-56491-19 · +243 bytes
     /* Patches */
     +1 added

     • At this point in time Amazon (AWS) have not released a patch for AL2023.

     +ref https://explore.alas.aws.amazon.com/CVE-2026-109618.html

190. 2026-10-21 20:31:27 UTC · Pcuser42 · -2 bytes
     /* Patches */ Consistently use DMY formats
     ~1 reworded

     • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif.
191. 2026-10-21 19:59:30 UTC · Agnuse13 · +0 bytes minor
     (no edit summary)
192. 2026-10-21 19:57:51 UTC · Agnuse13 · +8 bytes minor
     (no edit summary)
193. 2026-10-21 19:56:46 UTC · Agnuse13 · +432 bytes
     Added a key additional set of vulnerabilities for the impact
     +1 added

     • PHP is also bundled with vendor appliances, hosting control panels such as cPanel and Plesk, and some Windows applications.

     +ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil

194. 2026-10-21 19:28:14 UTC · Beland · +112 bytes
     linking and grammar and de-jargon a bit
     ~3 reworded

     • PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit would be feasible. PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit (software that actually uses the security hole to gain access) would be feasible.
     • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif.
     • PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo after development platform Chainguard released patched versions of the software early, allowing attackers to determine what code had been changed. Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed.
195. 2026-10-21 19:25:39 UTC · Novixoxoxo · +12 bytes
     (no edit summary)
     ~1 reworded

     • CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4–8.5 that allow remote code execution (RCE). CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two high-impact vulnerabilities in PHP versions 5.4–8.5 that allow remote code execution (RCE).
196. 2026-10-21 19:05:16 UTC · anonymous editor · +44 bytes
     Add current event
197. 2026-10-21 18:40:47 UTC · ~2026-56142-23 · +281 bytes
     /* Discovery */ added reference to official php foundation blog about the history of the discovery

     +ref https://thephp.foundation/blog/2026/10/21/todays-php-security-release-

198. 2026-10-21 18:37:06 UTC · LightNightLights · +5 bytes
     /* */ some changes to an occurence of an en-dash
     ~1 reworded

     • CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 – 8.5 that allow remote code execution (RCE). CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4–8.5 that allow remote code execution (RCE).
199. 2026-10-21 18:31:56 UTC · PhotographyEdits · -64 bytes
     no current event anymore: patches released, websites back online
200. 2026-10-21 18:29:00 UTC · Rtrb · +1 bytes minor
     added oxford comma
     ~1 reworded

     • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasy XIV and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasy XIV, and many online commerce sites.
201. 2026-10-21 18:20:26 UTC · Ahecht · -37 bytes mw-undo
     Undid revision [[Special:Diff/1381333092|1381333092]] by [[Special:Contributions/XTheBedrockX|XTheBedrockX]] ([[User talk:XTheBedrockX|talk]]) This is not a controversy, and only peripheral Wikipedia services were affected
202. 2026-10-21 18:10:41 UTC · LightNightLights · +414 bytes
     re-add {{[[Template:add Unreliable source|add Unreliable source]]}} templates for "The Hacker News" citations [removed in [[Special:Diff/1381327424]] by [[User:Ahecht]] • that edit's summary does not acknowledge the removal, so it likely has been removed accidentally]
203. 2026-10-21 18:08:23 UTC · XTheBedrockX · +37 bytes mw-reverted
     added [[Category:Wikipedia controversies]] using [[WP:HC|HotCat]]
204. 2026-10-21 17:59:42 UTC · Rtrb · +203 bytes
     /* Impact */ added japanese govt. advisory + fixed citation
     +1 added

     • The Japanese National Cybersecurity Office advised PHP users to immediately update their systems.
205. 2026-10-21 17:48:55 UTC · Rtrb · +25 bytes minor
     /* Impact */ fixed citation error
206. 2026-10-21 17:38:20 UTC · Rtrb · +482 bytes
     /* Impact */ added NSA citation and partial quote

     +ref https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release

207. 2026-10-21 17:37:47 UTC · ~2026-56411-51 · -5 bytes
     /* Patches */ removed the extraneous "by" and adjusted the flow
     ~1 reworded

     • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a video of a proof-of-concept mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept video mistakenly released by Calif.
208. 2026-10-21 17:31:32 UTC · Aidenzdavis · -3 bytes minor
     Fixed a small typo
     ~1 reworded

     • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a video of a proof-of-concept by mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a video of a proof-of-concept mistakenly released by Calif.
209. 2026-10-21 17:30:42 UTC · Ahecht · -248 bytes
     Remove commercial source

     −ref https://sansec.io/research/php2shell

210. 2026-10-21 17:28:40 UTC · Ahecht · +0 bytes
     /* Patches */ move ref to the correct place
211. 2026-10-21 17:27:24 UTC · Red Director · +39 bytes
     ref author
212. 2026-10-21 17:26:29 UTC · Ceratius · +344 bytes minor
     /* Impact */
     ~1 reworded

     • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasy XIV and many online commerce sites.

     +ref https://na.finalfantasyxiv.com/lodestone/news/detail/682d63eac6bb6c380

213. 2026-10-21 17:22:37 UTC · Ahecht · +228 bytes
     /* Patches */ add
     +1 added, −1 removed, ~1 reworded

     • PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo after development platform Chainguard released patched versions of the software early, allowing attackers to determine what code had been changed.
     • PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo.
     • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and was confirmed by the X account of cybersecurity company watchTowr labs. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a video of a proof-of-concept by mistakenly released by Calif.
214. 2026-10-21 17:18:08 UTC · ~2026-56305-56 · +1 bytes
     fix typo
     ~1 reworded

     • A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and since a specific explot had not yet been discovered, the work to resolve it was not completed. A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and since a specific exploit had not yet been discovered, the work to resolve it was not completed.
215. 2026-10-21 17:16:31 UTC · Chino O'Chénelle · +181 bytes minor
     /* Impact */ Added citations confirming Umamusume: Pretty Derby went offline for updating PHP.

     +ref https://umamusume.jp/news/detail?id=3523

216. 2026-10-21 17:15:04 UTC · Ahecht · -64 bytes
     /* Discovery */ add information on 2024 discovery, re-order
     +1 added, ~2 reworded

     • A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and since a specific explot had not yet been discovered, the work to resolve it was not completed.
     • The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. The two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc.
     • PHP versions as early as 5.4 are affected, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit would be feasible. PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit would be feasible.
217. 2026-10-21 17:14:14 UTC · LightNightLights · -2 bytes
     /* */ use {{[[Template:Flatlist|Flatlist]]}} instead of {{[[Template:Plain list|Plain list]]}} for "Discoverer" entries in infobox [less empty space with a flatlist than a plainlist]
218. 2026-10-21 17:11:21 UTC · LightNightLights · +414 bytes
     tag citations to "The Hacker News" (not the forum named "Hacker News") as possibly unreliable [uses AI for images, so likely also uses AI for text • very-rough consensus of unreliability, per [[WP:NPPSG]]]
219. 2026-10-21 17:06:08 UTC · Ahecht · +24 bytes
     /* Discovery */ Clarify on the timeline here. The official PHP post doesn't agree with the claim of decades earlier, and PHP 5.4 was only released 14 years ago.
     +1 added, −1 removed

     • PHP versions as early as 5.4 are affected, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit would be feasible.
     • PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades before, it was not fixed at the time as it was not thought that an exploit would be feasible.
220. 2026-10-21 17:02:57 UTC · Rtrb · -52 bytes
     removed inline link: citation already has this url
221. 2026-10-21 17:01:45 UTC · Ahecht · -29 bytes
     /* Discovery */ replace self-published source

     +ref https://thenextweb.com/news/php-foundation-structural-failure-2024-fla −ref https://openai.com/index/coordinated-disclosure-of-critical-vulnerabil

222. 2026-10-21 16:54:23 UTC · 4Seasons4 · +34 bytes minor
     Edited external link to be date-specific.
223. 2026-10-21 16:53:17 UTC · Ahecht · +0 bytes
     /* Patches */ move ref
224. 2026-10-21 16:52:00 UTC · QuillQuasar · +38 bytes
     French outage was Interior Ministry sites per Reuters; fix Reuters and NCSC cites; tag Umamusume
     ~1 reworded

     • Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry.
225. 2026-10-21 16:51:12 UTC · Ahecht · -6 bytes
     /* Impact */ rm unnecessary pipe
226. 2026-10-21 16:50:27 UTC · Ahecht · +0 bytes minor
     /* Discovery */ fix
227. 2026-10-21 16:50:02 UTC · Ahecht · -14 bytes minor
     /* Discovery */ unnecessary pipe
228. 2026-10-21 16:49:17 UTC · QuillQuasar · +821 bytes
     Add exploitation status per watchTowr and NBC; add BleepingComputer cite for Cloudflare
     +1 added

     • Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency (CISA) said it had not observed exploitation as of the same day.

     +ref https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ +ref https://www.bleepingcomputer.com/news/security/php-ships-emergency-pat

229. 2026-10-21 16:48:27 UTC · Ahecht · +2 bytes
     fix {{subref}}
230. 2026-10-21 16:47:59 UTC · Ahecht · +271 bytes
     add cite

     +ref https://www.nytimes.com/2026/09/08/us/politics/calif-ai-worm-wechat-ha

231. 2026-10-21 16:46:30 UTC · 4Seasons4 · +26 bytes
     Links
232. 2026-10-21 16:46:06 UTC · QuillQuasar · +769 bytes
     Restore Ahecht's WSJ quotes and wording, lost in my earlier edit
     +1 added, −1 removed

     • PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades before, it was not fixed at the time as it was not thought that an exploit would be feasible.
     • PHP versions as early as 5.4 are affected, and the underlying flaws had gone undetected in PHP's code for more than a decade.
233. 2026-10-21 16:42:52 UTC · 4Seasons4 · +4 bytes minor
     Added a link
234. 2026-10-21 16:42:07 UTC · QuillQuasar · +283 bytes
     Add patched version numbers and PHP's mitigation advice; tag uncited timestamp
     +1 added, ~1 reworded

     • Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice.
     • The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5. The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12).
235. 2026-10-21 16:40:57 UTC · QuillQuasar · -455 bytes
     Discovery: cite August 2026 date to Sansec; correct flaw age per BBC and Reuters; tag one claim
     +1 added, ~1 reworded

     • PHP versions as early as 5.4 are affected, and the underlying flaws had gone undetected in PHP's code for more than a decade.
     • The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades before, it was not fixed at the time as it was not thought that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc.

     +ref https://sansec.io/research/php2shell

236. 2026-10-21 16:40:09 UTC · Ahecht · +726 bytes
     add quotes
     ~1 reworded

     • The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades earlier, it was not fixed at the time as it was not thought that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades before, it was not fixed at the time as it was not thought that an exploit would be feasible.
237. 2026-10-21 16:39:05 UTC · Padgriffin · -92 bytes
     /* Impact */ Not sure we need the 4chan screenshot here, the Phab screenshot already works very well as a visual aid, else this start turning into a gallery of maintenance notices
238. 2026-10-21 16:36:36 UTC · 4Seasons4 · +18 bytes minor
     Link added
239. 2026-10-21 16:35:21 UTC · 4Seasons4 · -3 bytes minor
     Grammar changes.
     ~1 reworded

     • Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby and Shadowverse: Worlds Beyond, and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, and many online commerce sites.
240. 2026-10-21 16:34:53 UTC · Padgriffin · +7 bytes
     (no edit summary)
     ~1 reworded

     • CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 –8.5 that allow remote code execution. CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 – 8.5 that allow remote code execution (RCE).
241. 2026-10-21 16:34:03 UTC · ~2026-56304-51 · +92 bytes
     /* Impact */
242. 2026-10-21 16:30:00 UTC · Ahecht · -12 bytes
     use {{url}}
243. 2026-10-21 16:28:58 UTC · Ahecht · +4 bytes
     restore link to [[GitHub]]
244. 2026-10-21 16:28:37 UTC · IngeniousPachyderm · -1 bytes
     /* Impact */ updated to present tense
     ~1 reworded

     • Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread. Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts are widespread.
245. 2026-10-21 16:28:17 UTC · Padgriffin · +54 bytes
     adding website for exploit
246. 2026-10-21 16:26:05 UTC · Ahecht · -29 bytes
     Remove [[WP:OVERLINK]] and inline external links, c/e
     ~1 reworded

     • Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites.
247. 2026-10-21 16:23:42 UTC · ~2026-56304-51 · +6 bytes
     /* Impact */ Proper spelling
248. 2026-10-21 16:20:00 UTC · NightWolf1223 · -23 bytes
     /* External links */ not a stub
249. 2026-10-21 16:16:42 UTC · Padgriffin · +200 bytes
     Citing versions, Wiz states that 5.4 was the first version affected, NIST and PHP only listed 8.2-8.5 due to those getting patches
     ~3 reworded

     • CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5–8 that allow remote code execution. CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 –8.5 that allow remote code execution.
     • Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites.
     • Parts of the Japanese internet also went offline, including the online card game Shadowverse: Worlds Beyond and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby and Shadowverse: Worlds Beyond, and many online commerce sites.

     +ref https://www.wiz.io/blog/php2shell-php-rce

250. 2026-10-21 16:15:49 UTC · LucasBrown · +2 bytes minor
     [[MOS:DASHVAR]]
     ~1 reworded

     • CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5-8 that allow remote code execution. CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5–8 that allow remote code execution.
251. 2026-10-21 16:14:13 UTC · 4Seasons4 · +4 bytes minor
     One link added
252. 2026-10-21 16:13:00 UTC · 4Seasons4 · +36 bytes minor
     More links added.
253. 2026-10-21 16:09:35 UTC · Beland · -4 bytes
     /* Patches */ grammar
     ~1 reworded

     • Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability.
254. 2026-10-21 16:08:16 UTC · Ahecht · +27 bytes
     add cite
255. 2026-10-21 16:06:23 UTC · TheXug · -3 bytes minor
     /* Impact */ Fixed grammar
     ~1 reworded

     • Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites.
256. 2026-10-21 16:05:41 UTC · SeaSpace · +1 bytes minor
     typo fix
     ~1 reworded

     • The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades earlier, it was not fixed at the time as it was not thought that an exploit would be feasible.
257. 2026-10-21 16:04:42 UTC · 4Seasons4 · +125 bytes minor
     Added links to other articles where useful.
258. 2026-10-21 16:03:52 UTC · Ahecht · -35 bytes
     /* Discovery */ c/e
     ~1 reworded

     • The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as PHP 5.4, all the way through to PHP 8, are affected, and while the security flaw has been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible.
259. 2026-10-21 16:03:12 UTC · Ahecht · -14 bytes
     /* Discovery */ not need to credit that to Wiz
     ~1 reworded

     • The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected, and while the security flaw has been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as PHP 5.4, all the way through to PHP 8, are affected, and while the security flaw has been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible.
260. 2026-10-21 16:02:45 UTC · Ahecht · +673 bytes
     /* Discovery */ add
     ~1 reworded

     • The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project, and by the Israeli-American cloud security company Wiz, Inc. According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected, and while the security flaw has been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible.

     +ref https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two +ref https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-u −ref https://www.wiz.io/blog/php2shell-php-rce

261. 2026-10-21 15:58:06 UTC · 4Seasons4 · -4 bytes minor
     Removed unnecessary softlink.
262. 2026-10-21 15:56:16 UTC · Bnuuy · -10 bytes minor
     /* Impact */ rephrase
     ~1 reworded

     • The US National Security Agency recommended that websites go offline if they're not able to immediately update. The US National Security Agency recommended that websites go offline if unable to update immediately.
263. 2026-10-21 15:55:11 UTC · Ahecht · +17 bytes
     /* See also */ add [[Heartbleed]], given as a similar level of vulnerability by Volker Dusch as quoted in the WSJ article
264. 2026-10-21 15:54:26 UTC · Bnuuy · +17 bytes
     adjust lede
     ~1 reworded

     • CVE-2026-109618 and CVE-2026-109619 are two vulnerabilities in PHP that allow remote code execution and are together known as PHP2Shell. CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5-8 that allow remote code execution.
265. 2026-10-21 15:52:15 UTC · Xymph · +0 bytes minor
     update anchor to php advisory

     +ref https://www.php.net/archive/2026.php#2026-10-21-5 −ref https://www.php.net/archive/2026.php#2026-10-21-1

266. 2026-10-21 15:51:44 UTC · Benjamin Loison · +1 bytes minor
     /* Impact */ Correct a typo
     ~1 reworded

     • Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school comunication platform, all Finnish government public-facing web services, and French local government administration websites. Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites.
267. 2026-10-21 15:50:42 UTC · Ahecht · +37 bytes
     /* Impact */ add cite
268. 2026-10-21 15:49:55 UTC · GreenRunner0 · +0 bytes minor
     /* Impact */
     ~1 reworded

     • Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school comunication platform, all Finnish government public-facing web services, and French local gobernment administration websites. Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school comunication platform, all Finnish government public-facing web services, and French local government administration websites.
269. 2026-10-21 15:49:09 UTC · Ahecht · +426 bytes
     /* Impact */ add
     +1 added

     • The US National Security Agency recommended that websites go offline if they're not able to immediately update.

     +ref https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-cons

270. 2026-10-21 15:46:39 UTC · GreenRunner0 · +448 bytes
     /* Impact */ Japan
     +1 added

     • Parts of the Japanese internet also went offline, including the online card game Shadowverse: Worlds Beyond and many online commerce sites.

     +ref https://www.itmedia.co.jp/news/article/2610/21/2000002472/

271. 2026-10-21 15:45:43 UTC · LightNightLights · +87 bytes
     /* Discovery */ mark OpenAI and Wiz's citations as possibly [[WP:SPS|self-published]]
272. 2026-10-21 15:45:20 UTC · Ahecht · +358 bytes
     /* Impact */ add
     ~1 reworded

     • Approximately 69% of websites use PHP, so the potential impacts were widespread. Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread.
273. 2026-10-21 15:39:47 UTC · Ahecht · +861 bytes
     /* Impact */ update
     +2 added, ~1 reworded

     • Approximately 69% of websites use PHP, so the potential impacts were widespread.
     • The Wikimedia Foundation shut down many of their supporting services, and forum sites 4Chan and Something Awful went offline.
     • Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending. Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school comunication platform, all Finnish government public-facing web services, and French local gobernment administration websites.

     +ref https://diff.wikimedia.org/2026/10/21/impact-of-php-vulnerabilities-on

274. 2026-10-21 15:34:25 UTC · Zenphia1 · +0 bytes mw-undo
     Undid revision [[Special:Diff/1381316773|1381316773]] by [[Special:Contributions/Zenphia1|Zenphia1]] ([[User talk:Zenphia1|talk]])
275. 2026-10-21 15:34:08 UTC · Zenphia1 · +0 bytes mw-reverted
     (no edit summary)
276. 2026-10-21 15:33:33 UTC · Zenphia1 · +11 bytes
     (no edit summary)
277. 2026-10-21 15:30:38 UTC · Graham87 · -1 bytes minor
     /* Patches */ grammar
     ~1 reworded

     • The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and were confirmed by the X account of cybersecurity company watchTowr labs. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and was confirmed by the X account of cybersecurity company watchTowr labs.
278. 2026-10-21 15:28:59 UTC · Graham87 · +1 bytes minor
     typo
     ~1 reworded

     • An emergency patch and details about the vulnerabilites were released on the following day. An emergency patch and details about the vulnerabilities were released on the following day.
279. 2026-10-21 15:28:07 UTC · GreenRunner0 · +579 bytes
     /* Impact */ UK advice too
     ~1 reworded

     • Following an advice from CERT-EU, many organizations across Europe took their websites offline as a precaution while the patches were pending. Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending.

     +ref https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-upd +ref https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

280. 2026-10-21 15:27:48 UTC · Paoepaoanida · +0 bytes
     /* */ fixed grammar
     ~1 reworded

     • An emergency patch and details about the vulnerabilites was released on the following day. An emergency patch and details about the vulnerabilites were released on the following day.
281. 2026-10-21 15:25:57 UTC · Zenphia1 · +0 bytes
     (no edit summary)
     ~1 reworded

     • An emergency patch and details about the vulnerability were released on the following day. An emergency patch and details about the vulnerabilites was released on the following day.
282. 2026-10-21 15:25:32 UTC · Zenphia1 · -19 bytes
     (no edit summary)
     ~1 reworded

     • The existence of the vulnerability was publicly announced on 20 October 2026. Their existence was publicly announced on 20 October 2026.
283. 2026-10-21 15:23:51 UTC · LightNightLights · -297 bytes
     /* Discovery */ remove "The Hacker News" source [very-rough consensus of unreliability at [[WP:NPPSG]] • uses AI for its article images, thus likely also uses AI for its article text]

     −ref https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two

284. 2026-10-21 15:22:59 UTC · Ahecht · +20 bytes
     /* Patches */ re-add source
285. 2026-10-21 15:21:49 UTC · Padgriffin · -236 bytes
     /* Patches */ Rm claim, not clear how much those companies had contributed to the actual patches and it's sourced to a press release anyways
     ~1 reworded

     • The maintainers of PHP worked with companies including Wiz, Cloudflare, and OpenAI to develop and release patched version of PHP 8.2, 8.3, 8.4, and 8.5. The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5.
286. 2026-10-21 15:19:41 UTC · Pieceofmetalwork · +1,253 bytes
     Impact
     +1 added

     • Following an advice from CERT-EU, many organizations across Europe took their websites offline as a precaution while the patches were pending.

     +ref https://www.bbc.com/news/articles/cmly0lg3w5x2o +ref https://www.brusselstimes.com/belgium/2371464/major-websites-go-offlin +ref https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-ma

287. 2026-10-21 15:13:01 UTC · LightNightLights · -62 bytes
     /* Patches */ remove citation tagged as failed verification [tagged by me in a previous edit • to avoid tag-clutter]
288. 2026-10-21 15:11:00 UTC · Ashmoo · +2 bytes
     /* Patches */
289. 2026-10-21 15:09:37 UTC · Ashmoo · +26 bytes
     (no edit summary)
290. 2026-10-21 15:05:10 UTC · LightNightLights · +118 bytes
     /* */ mark Wiz/Cloudflare/OpenAI-collaboration statement with tags
291. 2026-10-21 14:54:46 UTC · Ashmoo · -32 bytes
     source doesn't indicate this is notable. reinclude with exactly why it is notable.
     ~1 reworded

     • It is notable for the fact that the PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and were confirmed by the X account of cybersecurity company watchTowr labs. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and were confirmed by the X account of cybersecurity company watchTowr labs.
292. 2026-10-21 14:52:47 UTC · Ahecht · +605 bytes
     Add
     +1 added, ~1 reworded

     • It is notable for the fact that the PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and were confirmed by the X account of cybersecurity company watchTowr labs.
     • It is notable for the fact that the PHP maintainers announced the update early and before release, encouraging users to prepare and update as soon as the patch was released. The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released.

     +ref https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two +ref https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php −ref https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell

293. 2026-10-21 14:52:22 UTC · Ashmoo · +5 bytes
     (no edit summary)
     ~1 reworded

     • The existence of the vulnerability was publicly announced on 20 October. The existence of the vulnerability was publicly announced on 20 October 2026.
294. 2026-10-21 14:51:19 UTC · Rchard2scout · +1 bytes minor
     Grammar fix ("was" -> "were" in lead)
     ~1 reworded

     • An emergency patch and details about the vulnerability was released on the following day. An emergency patch and details about the vulnerability were released on the following day.
295. 2026-10-21 14:42:05 UTC · Ahecht · +914 bytes
     update
     +3 added, −1 removed

     • The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project, and by the Israeli-American cloud security company Wiz, Inc. According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected.
     • The maintainers of PHP worked with companies including Wiz, Cloudflare, and OpenAI to develop and release patched version of PHP 8.2, 8.3, 8.4, and 8.5.
     • Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life.
     • According to discoverer Wiz, Inc, versions as early as PHP 5.4, all the way through to PHP 8, are affected.

     +ref https://openai.com/index/coordinated-disclosure-of-critical-vulnerabil

296. 2026-10-21 14:41:01 UTC · Nemoralis · +34 bytes mw-undo
     Undid revision [[Special:Diff/1381309962|1381309962]] by [[Special:Contributions/Ahecht|Ahecht]] ([[User talk:Ahecht|talk]]); [[WP:REVEXP]]
297. 2026-10-21 14:32:50 UTC · PhotographyEdits · +39 bytes
     add links
298. 2026-10-21 14:29:08 UTC · Fregatatta · +4 bytes minor
     add wiktionary link
299. 2026-10-21 14:27:24 UTC · Ahecht · -34 bytes mw-undo mw-reverted
     Undid revision [[Special:Diff/1381309826|1381309826]] by [[Special:Contributions/Nemoralis|Nemoralis]] ([[User talk:Nemoralis|talk]])
300. 2026-10-21 14:26:23 UTC · Streetr4 · -109 bytes mw-undo minor
     Undid revision [[Special:Diff/1381309714|1381309714]] by [[Special:Contributions/~2026-56204-88|~2026-56204-88]] ([[User talk:~2026-56204-88|talk]]): Speculation
     −1 removed

     • Many websites using PHP have shut down already, and future shutdowns are expected until a fix is released.
301. 2026-10-21 14:25:59 UTC · Nemoralis · +34 bytes mw-reverted
     add website
302. 2026-10-21 14:25:28 UTC · Nintendofan885 · +9 bytes
     should be 'Phabricator instance'
303. 2026-10-21 14:24:53 UTC · ~2026-56204-88 · +109 bytes mw-reverted
     added a short line mentioning website shutdowns
     +1 added

     • Many websites using PHP have shut down already, and future shutdowns are expected until a fix is released.
304. 2026-10-21 14:22:22 UTC · ItzSwirlz · +18 bytes
     discoverer
305. 2026-10-21 14:15:09 UTC · PhotographyEdits · +5 bytes
     improve first sentence
     +1 added, −1 removed

     • CVE-2026-109618 and CVE-2026-109619 are two vulnerabilities in PHP that allow remote code execution and are together known as PHP2Shell.
     • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a remote code execution vulnerability reported in October 2026 in the common web scripting language PHP.
306. 2026-10-21 14:08:53 UTC · ~2026-56383-01 · -111 bytes
     addressed + no more need
307. 2026-10-21 14:02:05 UTC · Ahecht · +224 bytes
     update link

     +ref https://www.php.net/archive/2026.php#2026-10-21-1

308. 2026-10-21 13:59:18 UTC · Ca · -25 bytes
     more precise term
     ~1 reworded

     • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a arbitrary code execution vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a remote code execution vulnerability reported in October 2026 in the common web scripting language PHP.
309. 2026-10-21 13:58:43 UTC · Gemdation · +219 bytes minor
     Ars Tech down... so sad
310. 2026-10-21 13:56:51 UTC · Ca · -78 bytes
     Wiz seems to repeat the 9.2 figure
     −1 removed

     • Wiz Research who discovered it said the severity reached 10.
311. 2026-10-21 13:53:57 UTC · Ca · -282 bytes
     (no edit summary)
     +2 added, −1 removed, ~1 reworded

     • The existence of the vulnerability was publicly announced on 20 October.
     • An emergency patch and details about the vulnerability was released on the following day.
     • The existence of the vulnerability was announced on 20 October and an emergency patch was released on 21 October at 14:00 UTC together with all other information about the vulnerability.
     • Early reporting suggest versions as early as PHP 5, all the way through to PHP 8, are affected. According to discoverer Wiz, Inc, versions as early as PHP 5.4, all the way through to PHP 8, are affected.

     −ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil

312. 2026-10-21 13:53:29 UTC · Warp03 · +4 bytes
     (no edit summary)
     ~1 reworded

     • Both vulnerabilities were published through GitHub security advisories on 21 October at 15:34, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. Both vulnerabilities were published through GitHub security advisories on 21 October at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter.
313. 2026-10-21 13:53:02 UTC · Warp03 · +527 bytes
     (no edit summary)
     +1 added

     • Both vulnerabilities were published through GitHub security advisories on 21 October at 15:34, 26 minutes before the announced release time, with the PHP website updated shortly thereafter.

     +ref https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp +ref https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

314. 2026-10-21 13:48:24 UTC · Ca · +255 bytes
     restore accidentally deletion
     +1 added

     • Wiz Research who discovered it said the severity reached 10.

     +ref https://www.wiz.io/blog/php2shell-php-rce

315. 2026-10-21 13:46:43 UTC · Ca · -286 bytes
     fix has been released
     +1 added, −1 removed, ~4 reworded

     • Early reporting suggest versions as early as PHP 5, all the way through to PHP 8, are affected.
     • While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
     • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a arbitrary code execution vulnerability reported in October 2026 in the common web scripting language PHP.
     • The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, but Wiz Research who discovered it said the severity reached 10. The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0.
     • Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on 21 October at 14:00 UTC together with all other information about the vulnerability. The existence of the vulnerability was announced on 20 October and an emergency patch was released on 21 October at 14:00 UTC together with all other information about the vulnerability.
     • PoCs, write-ups, and partial mitigations started circulating on the Internet. PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo.

     −ref https://www.wiz.io/blog/php2shell-php-rce

316. 2026-10-21 13:45:10 UTC · Ms7821 · +259 bytes
     Add Wiz cite
     ~1 reworded

     • The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers. The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, but Wiz Research who discovered it said the severity reached 10.

     +ref https://www.wiz.io/blog/php2shell-php-rce

317. 2026-10-21 13:42:45 UTC · Padgriffin · -3 bytes
     (no edit summary)
318. 2026-10-21 13:42:33 UTC · Padgriffin · +44 bytes
     (no edit summary)
319. 2026-10-21 13:26:40 UTC · Crtbob · +598 bytes mw-rollback minor
     [[WP:CVPI|Interceptor]]: Reverting unexplained deletion by [[Special:Contributions/~2026-56282-91|~2026-56282-91]]
     ~1 reworded

     • Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation againsT Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability.

     +ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st +ref https://x.com/dok2001/status/2112811965735202970

320. 2026-10-21 13:26:24 UTC · ~2026-56282-91 · -598 bytes mw-reverted
     (no edit summary)
     ~1 reworded

     • Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation againsT

     −ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st −ref https://x.com/dok2001/status/2112811965735202970

321. 2026-10-21 13:26:17 UTC · Crtbob · +581 bytes mw-rollback minor
     [[WP:CVPI|Interceptor]]: Reverting unexplained deletion by [[Special:Contributions/~2026-56282-91|~2026-56282-91]]
     +1 added, ~1 reworded

     • While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
     • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common webh 8. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP.

     +ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two

322. 2026-10-21 13:25:57 UTC · ~2026-56282-91 · -581 bytes mw-reverted
     (no edit summary)
     −1 removed, ~1 reworded

     • While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
     • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common webh 8.

     −ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two

323. 2026-10-21 13:05:23 UTC · Ms7821 · +318 bytes minor
     Fix forward cite

     +ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two

324. 2026-10-21 13:04:29 UTC · Laura240406 · +21 bytes
     link
325. 2026-10-21 13:02:03 UTC · PhotographyEdits · +114 bytes
     add external link of the announcement
326. 2026-10-21 13:00:41 UTC · PhotographyEdits · +2 bytes
     expand abbreviation
     ~1 reworded

     • Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary WAF rules as an attempted stopgap mitigation against the vulnerability. Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability.
327. 2026-10-21 12:58:16 UTC · Ms7821 · -394 bytes
     Undo https://en.wikipedia.org/w/index.php?title=PHP2Shell&diff=prev&oldid=1381288860, which is not matched by citations or searches
     ~1 reworded

     • The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers.

     −ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two

328. 2026-10-21 12:55:59 UTC · LightNightLights · -34 bytes
     /* */ [[WP:BOLD]]-ly revise Phabricator-image caption
329. 2026-10-21 12:34:50 UTC · Padgriffin · +184 bytes
     Adding screenshot of the Phabricator as a visual aid for sites being disabled during the pre-patch chaos
330. 2026-10-21 12:28:54 UTC · LightNightLights · -1 bytes
     /* */ some MOS changes ([[MOS:BADDATE]], [[MOS:RANGE]])
     ~2 reworded

     • While the information about the vulnerability has been embargoed until 21nd October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
     • Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October at 14:00 UTC together with all other information about the vulnerability. Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on 21 October at 14:00 UTC together with all other information about the vulnerability.
331. 2026-10-21 12:24:19 UTC · Warp03 · +72 bytes
     (no edit summary)
     ~2 reworded

     • While the information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While the information about the vulnerability has been embargoed until 21nd October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
     • Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October at 14:00 UTC. Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October at 14:00 UTC together with all other information about the vulnerability.

     +ref https://www.php.net/archive/2026.php#2026-10-20-1 −ref https://www.php.net/archive/2026.php

332. 2026-10-21 12:19:29 UTC · Ca · +272 bytes
     better source found (PC Gamer)

     +ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st

333. 2026-10-21 11:43:33 UTC · Mlkj · -144 bytes
     eMudhra incident is unrelated, except by date
334. 2026-10-21 11:38:35 UTC · Novem Linguae · +222 bytes
     {{better source needed}}
335. 2026-10-21 11:37:37 UTC · Novem Linguae · -1 bytes
     ce
336. 2026-10-21 11:37:23 UTC · Novem Linguae · +29 bytes
     wl
337. 2026-10-21 11:24:41 UTC · Padgriffin · +379 bytes
     (no edit summary)
     +1 added

     • Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary WAF rules as an attempted stopgap mitigation against the vulnerability.

     +ref https://x.com/dok2001/status/2112811965735202970

338. 2026-10-21 11:24:38 UTC · ~2026-56327-82 · +25 bytes
     eMudhra isn't really related to this incident without clarification
339. 2026-10-21 11:23:09 UTC · Ca · +18 bytes
     see also
340. 2026-10-21 11:22:52 UTC · PhotographyEdits · +23 bytes minor
     +{{Software-eng-stub}} using [[User:SD0001/StubSorter|StubSorter]]
341. 2026-10-21 11:22:32 UTC · Ca · +4 bytes
     (no edit summary)
     ~1 reworded

     • While information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While the information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
342. 2026-10-21 11:21:23 UTC · Ca · -1 bytes
     wrong date
     ~1 reworded

     • While information about the vulnerability has been embargoed until 22nd November at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
343. 2026-10-21 11:20:44 UTC · Ca · +129 bytes
     (no edit summary)
     ~2 reworded

     • Unconfirmed reports claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While information about the vulnerability has been embargoed until 22nd November at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
     • Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October 2026 at 14:00 UTC. Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October at 14:00 UTC.
344. 2026-10-21 11:20:28 UTC · ~2026-56187-17 · +229 bytes
     Known state of public PoCs, mitigations and write-ups
     +1 added

     • PoCs, write-ups, and partial mitigations started circulating on the Internet.

     +ref https://jackalsyn.com/posts/php-up-2026.html

345. 2026-10-21 11:10:15 UTC · PhotographyEdits · +131 bytes
     add eMudhra see also link
346. 2026-10-21 11:01:34 UTC · ~2026-56352-28 · +31 bytes
     Changed statement about remote code execution to include 'unconfirmed reports claim that' to better reflect source cited.
     ~1 reworded

     • It allows arbitrary code execution on any website that runs PHP versions 5 through 8. Unconfirmed reports claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.
347. 2026-10-21 10:55:11 UTC · Strongshorts · +11 bytes
     /* */ Added clarification that 9.2 is a Critical vulnerability
     ~1 reworded

     • The vulnerability was rated 9.2 out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0.
348. 2026-10-21 10:48:42 UTC · Largely Legible Layman · +0 bytes
     moved citation outside punctuation
349. 2026-10-21 10:11:35 UTC · Tenshi Hinanawi · -8 bytes
     [[WP:NOELBODY]]
     ~1 reworded

     • PHP2Shell (' and ') is a vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP.
350. 2026-10-21 10:05:36 UTC · Padgriffin · +1 bytes
     (no edit summary)
351. 2026-10-21 10:03:31 UTC · Ca · +395 bytes
     clarify
     ~1 reworded

     • The vulnerability was rated 9.2 out of 10 under CVSS v4.0. The vulnerability was rated 9.2 out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0.

     +ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two

352. 2026-10-21 09:39:59 UTC · Padgriffin · +182 bytes
     (no edit summary)
353. 2026-10-21 09:35:37 UTC · Lordseriouspig · +8 bytes
     Add CVE link
     ~1 reworded

     • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (' and ') is a vulnerability reported in October 2026 in the common web scripting language PHP.
354. 2026-10-21 09:29:06 UTC · Lordseriouspig · +32 bytes
     update language used in current template
355. 2026-10-21 09:24:13 UTC · Lordseriouspig · +30 bytes
     Added {{[[Template:Current|Current]]}} tag
356. 2026-10-21 09:21:43 UTC · Novem Linguae · +0 bytes
     ce
357. 2026-10-21 08:58:43 UTC · ~2026-56237-46 · +1 bytes
     fix typo
     ~1 reworded

     • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in thecommon web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP.
358. 2026-10-21 08:43:17 UTC · Ltbdl · +93 bytes
     adding the most important part
     +1 added, ~1 reworded

     • It allows arbitrary code execution on any website that runs PHP versions 5 through 8.
     • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in thecommon web scripting language PHP.
359. 2026-10-21 08:33:38 UTC · JackDunnCodes · +1,223 bytes
     (no edit summary)
     +3 added

     • Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October 2026 at 14:00 UTC.
     • It is notable for the fact that the PHP maintainers announced the update early and before release, encouraging users to prepare and update as soon as the patch was released.
     • One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release".

     +ref https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell +ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil +ref https://www.php.net/archive/2026.php

360. 2026-10-21 08:27:42 UTC · Ljcool2006 · +17 bytes
     (no edit summary)
361. 2026-10-21 08:27:06 UTC · Ljcool2006 · +98 bytes
     (no edit summary)
362. 2026-10-21 08:14:01 UTC · LightNightLights · +6 bytes
     /* */ unbold "and" between CVE IDs
363. 2026-10-21 07:50:23 UTC · Ca · +59 bytes
     Adding [[Wikipedia:Short description|short description]]: "2026 software security vulnerability"
364. 2026-10-21 07:50:01 UTC · Ca · +824 bytes
     [[WP:AES|←]]Created page with ''''PHP2Shell''' ('''CVE-2026-109618 and CVE-2026-109619''') is a [[Vulnerability (computer security)|vulnerability]] reported in October 2026 in common web scripting language [[PHP]].<ref>{{Cite web |last=Goodin |first=Dan |date=2026-10-21 |title=PHP warns it plans to release 2 emergency patches imminently |url=https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/ |access-date=2026-10-21...'
     +2 added

     • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in common web scripting language PHP.
     • The vulnerability was rated 9.2 out of 10 under CVSS v4.0.

Edit summaries and text are Wikipedia's, CC BY-SA 4.0, by its contributors, shown as text.