# Every edit of Wikipedia's PHP2Shell article, as what it changed > Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source. All 364 revisions of the article as the statements each one added, removed or reworded, with the editor, the size and the reverts. [Wikipedia, as a graph](../../index.html) / [PHP2Shell](../index.html) / Every edit # Every edit of Wikipedia's PHP2Shell article, as what it changed 364 revisions from 2026-10-21 07:50:01 UTC to 2026-10-24 21:41:44 UTC, by 173 named editors and 1 anonymous edits, newest first. Wikipedia shows an edit as a diff of markup; here it is the statements the edit added, removed or reworded, so an edit reads as what it did to the account. 41 revisions were reverts or were reverted. Each entry links to the editor's public Wikipedia page; anonymous editors are never identified. Every hour from 2026-10-21 07:50:01 UTC to 2026-10-24 21:41:44 UTC, UTC. - **2026-10-24 21:41:44 UTC** · [Cicada1010](https://en.wikipedia.org/wiki/User:Cicada1010) · -16 bytes mw-rollback minor [[WP:CVPI|Interceptor]]: Reverting non-constructive edits by [[Special:Contributions/~2026-56919-99|~2026-56919-99]]~3 rewordedPeeonHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. - PeeonHP is a popular programming language that many website and web application codebases are built upon. PHP is a popular programming language that many website and web application codebases are built upon. - PeeonHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. - **2026-10-24 21:41:36 UTC** · [~2026-56919-99](https://en.wikipedia.org/wiki/User:~2026-56919-99) · +0 bytes mw-reverted *(no edit summary)* - **2026-10-24 21:40:44 UTC** · [~2026-56919-99](https://en.wikipedia.org/wiki/User:~2026-56919-99) · +16 bytes mw-reverted *(no edit summary)*~3 rewordedPHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. PeeonHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. - PHP is a popular programming language that many website and web application codebases are built upon. PeeonHP is a popular programming language that many website and web application codebases are built upon. - PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. PeeonHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. - **2026-10-24 21:32:14 UTC** · [Tenshi Hinanawi](https://en.wikipedia.org/wiki/User:Tenshi_Hinanawi) · +29,801 bytes mw-rollback minor Reverted edit by [[Special:Contribs/~2026-56891-34|~2026-56891-34]] ([[User talk:~2026-56891-34|talk]]) to last version by Rtrb+39 added, −1 removedPHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. - Their existence was publicly announced on 20 October 2026. - An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits could be used. - PHP is a popular programming language that many website and web application codebases are built upon. - The vulnerabilities are estimated to affect nearly 70% of websites. - The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. - Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability. - Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research. - PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. - A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized. - The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. - The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12). - Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life. - Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice. - Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems. - Volunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versions from the patched source code so that server administrators could automate deployments without compiling PHP themselves. - In response to claims on X that unpatched older PHP releases left one-third of the internet permanently vulnerable, Surý stated that there were ways to patch and update the older versions as well. - The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X (formerly Twitter) by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. - The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released. - One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release". - Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed. - Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure. - Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall rules as an attempted stopgap mitigation against the vulnerability. - Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day. - The potential impacts of the vulnerability were widespread. - Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress. PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications. - Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. - Some Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyber Security. - The US National Security Agency recommended that websites go offline if unable to update immediately. - The NCSC released a similar warning, urging organizations to be wary of backdoors. - The Japanese National Cybersecurity Office advised PHP users to immediately update their systems. - The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws. - The Wikimedia Foundation shut down many of their supporting services, and forum sites such as 4chan and Something Awful went offline. - Several Japanese websites and applications also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. - The Internet Archive briefly shut down to fix the issue. - Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used by about two-thirds of the web at the time. - Commentary in The Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment. - Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk. - Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches. - REDIRECT Trump goverment +ref https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs +ref https://aws.amazon.com/blogs/security/amazon-threat-intelligence-ident +ref https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/ +ref https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai +ref https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp +ref https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w +ref https://mashable.com/tech/php-vulnerability-websites-offline-affected- +ref https://news-web.php.net/php.announce/509 +ref https://news.ycombinator.com/item?id=50167754 +ref https://scherzer.dev/Blog/20261022-php2shell-timeline +ref https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-P +ref https://thenextweb.com/news/php-foundation-structural-failure-2024-fla +ref https://thephp.foundation/blog/2026/10/21/todays-php-security-release- +ref https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ +ref https://www.afr.com/world/north-america/websites-go-dark-as-ai-discove +ref https://www.bbc.com/news/articles/cmly0lg3w5x2o +ref https://www.bleepingcomputer.com/news/security/php-ships-emergency-pat +ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two +ref https://www.brusselstimes.com/belgium/2371464/major-websites-go-offlin +ref https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-sing +ref https://www.cp24.com/news/canada/2026/10/21/canadian-apps-and-governme +ref https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/ +ref https://www.cve.org/CVERecord?id=CVE-2026-109618 +ref https://www.cve.org/CVERecord?id=CVE-2026-109619 +ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil +ref https://www.itmedia.co.jp/news/article/2610/21/2000002472/ +ref https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php +ref https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release +ref https://www.nytimes.com/2026/09/08/us/politics/calif-ai-worm-wechat-ha +ref https://www.nytimes.com/2026/10/22/technology/what-is-php-vulnerabilit +ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st +ref https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-cons +ref https://www.php.net/archive/2026.php#2026-10-20-1 +ref https://www.php.net/archive/2026.php#2026-10-21-5 +ref https://www.php.net/releases/index.php +ref https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-ma +ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet- +ref https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-compute +ref https://www.theguardian.com/technology/2026/oct/22/what-is-php-compute +ref https://www.wiz.io/blog/php2shell-php-rce +ref https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-u +ref https://x.com/dok2001/status/2112811965735202970 - **2026-10-24 21:31:13 UTC** · [~2026-56891-34](https://en.wikipedia.org/wiki/User:~2026-56891-34) · -29,801 bytes mw-reverted [[WP:AES|←]]Redirected page to [[Trump goverment]]+1 added, −39 removedREDIRECT Trump goverment - PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. - Their existence was publicly announced on 20 October 2026. - An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits could be used. - PHP is a popular programming language that many website and web application codebases are built upon. - The vulnerabilities are estimated to affect nearly 70% of websites. - The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. - Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability. - Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research. - PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. - A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized. - The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. - The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12). - Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life. - Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice. - Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems. - Volunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versions from the patched source code so that server administrators could automate deployments without compiling PHP themselves. - In response to claims on X that unpatched older PHP releases left one-third of the internet permanently vulnerable, Surý stated that there were ways to patch and update the older versions as well. - The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X (formerly Twitter) by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. - The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released. - One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release". - Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed. - Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure. - Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall rules as an attempted stopgap mitigation against the vulnerability. - Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day. - The potential impacts of the vulnerability were widespread. - Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress. PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications. - Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. - Some Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyber Security. - The US National Security Agency recommended that websites go offline if unable to update immediately. - The NCSC released a similar warning, urging organizations to be wary of backdoors. - The Japanese National Cybersecurity Office advised PHP users to immediately update their systems. - The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws. - The Wikimedia Foundation shut down many of their supporting services, and forum sites such as 4chan and Something Awful went offline. - Several Japanese websites and applications also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. - The Internet Archive briefly shut down to fix the issue. - Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used by about two-thirds of the web at the time. - Commentary in The Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment. - Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk. - Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches. −ref https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs −ref https://aws.amazon.com/blogs/security/amazon-threat-intelligence-ident −ref https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/ −ref https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai −ref https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp −ref https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w −ref https://mashable.com/tech/php-vulnerability-websites-offline-affected- −ref https://news-web.php.net/php.announce/509 −ref https://news.ycombinator.com/item?id=50167754 −ref https://scherzer.dev/Blog/20261022-php2shell-timeline −ref https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-P −ref https://thenextweb.com/news/php-foundation-structural-failure-2024-fla −ref https://thephp.foundation/blog/2026/10/21/todays-php-security-release- −ref https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ −ref https://www.afr.com/world/north-america/websites-go-dark-as-ai-discove −ref https://www.bbc.com/news/articles/cmly0lg3w5x2o −ref https://www.bleepingcomputer.com/news/security/php-ships-emergency-pat −ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two −ref https://www.brusselstimes.com/belgium/2371464/major-websites-go-offlin −ref https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-sing −ref https://www.cp24.com/news/canada/2026/10/21/canadian-apps-and-governme −ref https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/ −ref https://www.cve.org/CVERecord?id=CVE-2026-109618 −ref https://www.cve.org/CVERecord?id=CVE-2026-109619 −ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil −ref https://www.itmedia.co.jp/news/article/2610/21/2000002472/ −ref https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php −ref https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release −ref https://www.nytimes.com/2026/09/08/us/politics/calif-ai-worm-wechat-ha −ref https://www.nytimes.com/2026/10/22/technology/what-is-php-vulnerabilit −ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st −ref https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-cons −ref https://www.php.net/archive/2026.php#2026-10-20-1 −ref https://www.php.net/archive/2026.php#2026-10-21-5 −ref https://www.php.net/releases/index.php −ref https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-ma −ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet- −ref https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-compute −ref https://www.theguardian.com/technology/2026/oct/22/what-is-php-compute −ref https://www.wiz.io/blog/php2shell-php-rce −ref https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-u −ref https://x.com/dok2001/status/2112811965735202970 - **2026-10-24 21:19:40 UTC** · [Rtrb](https://en.wikipedia.org/wiki/User:Rtrb) · -4 bytes mw-undo Undid revision [[Special:Diff/1381795121|1381795121]] by [[Special:Contributions/~2026-56929-69|~2026-56929-69]] ([[User talk:~2026-56929-69|talk]]) - **2026-10-24 21:16:52 UTC** · [~2026-56929-69](https://en.wikipedia.org/wiki/User:~2026-56929-69) · +4 bytes mw-reverted *(no edit summary)* - **2026-10-24 21:06:04 UTC** · [Rtrb](https://en.wikipedia.org/wiki/User:Rtrb) · +18 bytes /* See also */ adjusted link text - **2026-10-24 20:25:05 UTC** · [~2026-56896-64](https://en.wikipedia.org/wiki/User:~2026-56896-64) · +19 bytes *(no edit summary)*+1 added, ~1 rewordedThe vulnerabilities are estimated to affect nearly 70% of websites. - PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of websites. PHP is a popular programming language that many website and web application codebases are built upon. - **2026-10-24 20:22:42 UTC** · [~2026-56896-64](https://en.wikipedia.org/wiki/User:~2026-56896-64) · +35 bytes memory safety~1 rewordedPHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. - **2026-10-24 19:52:09 UTC** · [Sleeps-Darkly](https://en.wikipedia.org/wiki/User:Sleeps-Darkly) · +518 bytes *(no edit summary)*+2 addedVolunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versions from the patched source code so that server administrators could automate deployments without compiling PHP themselves. - In response to claims on X that unpatched older PHP releases left one-third of the internet permanently vulnerable, Surý stated that there were ways to patch and update the older versions as well. - **2026-10-24 14:37:36 UTC** · [Pigsonthewing](https://en.wikipedia.org/wiki/User:Pigsonthewing) · -6 bytes /* */ not just commerce~1 rewordedPHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of the commercial world wide web. PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of websites. - **2026-10-24 13:52:49 UTC** · [PhotographyEdits](https://en.wikipedia.org/wiki/User:PhotographyEdits) · -2 bytes /* See also */ remove newline - **2026-10-24 13:52:37 UTC** · [PhotographyEdits](https://en.wikipedia.org/wiki/User:PhotographyEdits) · +41 bytes add link - **2026-10-24 13:02:31 UTC** · [~2026-56643-37](https://en.wikipedia.org/wiki/User:~2026-56643-37) · +0 bytes *(no edit summary)* - **2026-10-24 12:44:18 UTC** · [Surtsicna](https://en.wikipedia.org/wiki/User:Surtsicna) · -14 bytes simplifying links per [[WP:NOPIPE]] - **2026-10-24 09:04:05 UTC** · [Brandmeister](https://en.wikipedia.org/wiki/User:Brandmeister) · -5 bytes /* */ smoother flow~1 rewordedPHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. - **2026-10-24 04:16:10 UTC** · [Harizotoh9](https://en.wikipedia.org/wiki/User:Harizotoh9) · +0 bytes *(no edit summary)* - **2026-10-24 03:58:42 UTC** · [SoyUnEditorRandom](https://en.wikipedia.org/wiki/User:SoyUnEditorRandom) · +29 bytes *(no edit summary)* - **2026-10-24 03:13:41 UTC** · [Doc James](https://en.wikipedia.org/wiki/User:Doc_James) · +11 bytes /* Impact */ nice to be able to read it - **2026-10-24 02:38:48 UTC** · [Another Believer](https://en.wikipedia.org/wiki/User:Another_Believer) · +5,291 bytes Rescuing 28 sources and tagging 0 as dead. #IABot (v2.0.9.6) - **2026-10-24 01:44:04 UTC** · [PhageRules1](https://en.wikipedia.org/wiki/User:PhageRules1) · -128 bytes Undid revision 1381654262; claim not substantiated by citations given.−1 removedSome Japanese users compared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!. - **2026-10-24 01:37:29 UTC** · [Northern Moonlight](https://en.wikipedia.org/wiki/User:Northern_Moonlight) · +19 bytes /* Patches */~1 rewordedThe PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X (formerly Twitter) by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. - **2026-10-24 01:36:55 UTC** · [Northern Moonlight](https://en.wikipedia.org/wiki/User:Northern_Moonlight) · +38 bytes dmy date - **2026-10-24 01:23:58 UTC** · [Citation bot](https://en.wikipedia.org/wiki/User:Citation_bot) · +2 bytes Altered title. Add: authors 1-1. Removed parameters. Some additions/deletions were parameter name changes. | [[:en:WP:UCB|Use this bot]]. [[:en:WP:DBUG|Report bugs]]. | Suggested by RafaelTLS | #UCB_toolbar - **2026-10-24 01:17:46 UTC** · [Thomasfan1916](https://en.wikipedia.org/wiki/User:Thomasfan1916) · +0 bytes *(no edit summary)* - **2026-10-23 23:35:56 UTC** · [Dentsinhere43](https://en.wikipedia.org/wiki/User:Dentsinhere43) · +0 bytes improve refs−ref https://jackalsyn.com/posts/php-up-2026.html - **2026-10-23 23:07:26 UTC** · [Vitorperrut555](https://en.wikipedia.org/wiki/User:Vitorperrut555) · -1 bytes Cleaning up syntax using [[:en:User:Zackmann08/scripts/indent|indent.js]] - **2026-10-23 22:59:01 UTC** · [Sinus Pi](https://en.wikipedia.org/wiki/User:Sinus_Pi) · +686 bytes /* Patches */ backport information~1 rewordedBoth vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems. +ref https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/ +ref https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-P - **2026-10-23 22:52:25 UTC** · [Iridescence](https://en.wikipedia.org/wiki/User:Iridescence) · +0 bytes minor /* Impact */ fix typos~1 rewordedSome japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!. Some Japanese users compared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!. - **2026-10-23 22:43:04 UTC** · [~2026-56065-30](https://en.wikipedia.org/wiki/User:~2026-56065-30) · +1 bytes /* Impact */~1 rewordedSome japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game. Some japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!. - **2026-10-23 22:42:22 UTC** · [~2026-56065-30](https://en.wikipedia.org/wiki/User:~2026-56065-30) · +2 bytes /* Impact */ - **2026-10-23 22:41:48 UTC** · [~2026-56065-30](https://en.wikipedia.org/wiki/User:~2026-56065-30) · +125 bytes /* Impact */+1 addedSome japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game. - **2026-10-23 22:11:35 UTC** · [OrbitalVoid49](https://en.wikipedia.org/wiki/User:OrbitalVoid49) · -21 bytes /* See also */ [[MOS:NOTSEEAGAIN]] - **2026-10-23 19:57:02 UTC** · [BarrelProof](https://en.wikipedia.org/wiki/User:BarrelProof) · +14 bytes excess blank space - **2026-10-23 19:49:34 UTC** · [~2026-55979-03](https://en.wikipedia.org/wiki/User:~2026-55979-03) · +4 bytes wlnk - **2026-10-23 19:13:49 UTC** · [Freedom4U](https://en.wikipedia.org/wiki/User:Freedom4U) · +240 bytes /* Impact */ precision and re-organization of first sentence+2 added, −2 removedThe potential impacts of the vulnerability were widespread. - Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress. PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications. - Approximately 69% of websites worldwide use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread. - PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications. −ref https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-upd - **2026-10-23 17:22:04 UTC** · [DaSupremo](https://en.wikipedia.org/wiki/User:DaSupremo) · +0 bytes minor *(no edit summary)* - **2026-10-23 16:01:22 UTC** · [Achmad Rachmani](https://en.wikipedia.org/wiki/User:Achmad_Rachmani) · -13 bytes /* */ Alter: title, website. - **2026-10-23 14:43:46 UTC** · [ClueBot NG](https://en.wikipedia.org/wiki/User:ClueBot_NG) · -88 bytes mw-rollback minor Reverting possible vandalism by [[Special:Contribs/~2026-56713-33|~2026-56713-33]] to version by Qzd. [[WP:CBFP|Report False Positive?]] Thanks, [[WP:CBNG|ClueBot NG]]. (4563195) (Bot)−1 removedDONT USE THIS WESTITE PEOPLE EDIT THESE ARTICALS UNRELIEABLE thank you from a six grader - **2026-10-23 14:43:41 UTC** · [~2026-56713-33](https://en.wikipedia.org/wiki/User:~2026-56713-33) · +88 bytes mw-reverted *(no edit summary)*+1 addedDONT USE THIS WESTITE PEOPLE EDIT THESE ARTICALS UNRELIEABLE thank you from a six grader - **2026-10-23 14:41:47 UTC** · [Qzd](https://en.wikipedia.org/wiki/User:Qzd) · -36 bytes mw-rollback minor [[WP:CVPI|Interceptor]]: Reverting non-constructive edits by [[Special:Contributions/~2026-56713-33|~2026-56713-33]]−2 removed, ~1 rewordedPHP2Shell is a pair of high-impact computer vulnerabilities (CVE- - i was there when it happen - 2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host. PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host. - **2026-10-23 14:41:23 UTC** · [~2026-56713-33](https://en.wikipedia.org/wiki/User:~2026-56713-33) · +36 bytes mw-reverted *(no edit summary)*+2 added, ~1 rewordedPHP2Shell is a pair of high-impact computer vulnerabilities (CVE- - i was there when it happen - PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host. 2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host. - **2026-10-23 14:22:43 UTC** · [The Grid](https://en.wikipedia.org/wiki/User:The_Grid) · -9 bytes ce~1 rewordedCzech volunteer Ondřej Surý was credited with playing a crucial role automating the necessary patches. Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches. - **2026-10-23 14:04:19 UTC** · [Thatsmemira](https://en.wikipedia.org/wiki/User:Thatsmemira) · +8 bytes minor /* Impact */ grammar~1 rewordedThe Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. The Wikimedia Foundation shut down many of their supporting services, and forum sites such as 4chan and Something Awful went offline. - **2026-10-23 13:44:29 UTC** · [Masem](https://en.wikipedia.org/wiki/User:Masem) · +1 bytes /* Discovery */ flip para~1 rewordedPHP versions as early as 5.4 (released in 2012) are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. - **2026-10-23 13:41:34 UTC** · [Masem](https://en.wikipedia.org/wiki/User:Masem) · +364 bytes /* */+1 added, ~2 rewordedPHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of the commercial world wide web. - PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gain remote control of the website host. - An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits could be used. - **2026-10-23 13:11:57 UTC** · [Victor Matheus Amaral](https://en.wikipedia.org/wiki/User:Victor_Matheus_Amaral) · +46 bytes *(no edit summary)*~2 rewordedCloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall rules as an attempted stopgap mitigation against the vulnerability. - Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency (CISA) said it had not observed exploitation as of the same day. Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day. - **2026-10-23 10:42:43 UTC** · [Brandmeister](https://en.wikipedia.org/wiki/User:Brandmeister) · +20 bytes /* Patches */ wlinks - **2026-10-23 10:31:46 UTC** · [四特朗普通话](https://en.wikipedia.org/wiki/User:四特朗普通话) · +9 bytes minor *(no edit summary)* - **2026-10-23 10:10:06 UTC** · [Brandmeister](https://en.wikipedia.org/wiki/User:Brandmeister) · +19 bytes brief clarity~2 rewordedPHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). - Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread. Approximately 69% of websites worldwide use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread. - **2026-10-23 09:54:36 UTC** · [Guninvalid](https://en.wikipedia.org/wiki/User:Guninvalid) · -98 bytes /* See also */ just use the anl template instead - **2026-10-23 09:49:31 UTC** · [DragonFury](https://en.wikipedia.org/wiki/User:DragonFury) · +4 bytes minor /* See also */ - **2026-10-23 09:23:44 UTC** · [Salmon Of Ignorance](https://en.wikipedia.org/wiki/User:Salmon_Of_Ignorance) · +86 bytes see also - heartbleed - **2026-10-23 09:22:19 UTC** · [Salmon Of Ignorance](https://en.wikipedia.org/wiki/User:Salmon_Of_Ignorance) · +17 bytes *(no edit summary)*~1 rewordedSeveral Japanese websites also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. Several Japanese websites and applications also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. - **2026-10-23 09:21:48 UTC** · [Salmon Of Ignorance](https://en.wikipedia.org/wiki/User:Salmon_Of_Ignorance) · -5 bytes More correct language~1 rewordedParts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. Several Japanese websites also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. - **2026-10-23 08:34:25 UTC** · [Jcuhfehl](https://en.wikipedia.org/wiki/User:Jcuhfehl) · -133 bytes mw-undo Undid revision [[Special:Diff/1381548266|1381548266]] by [[Special:Contributions/Stormx007|Stormx007]] ([[User talk:Stormx007|talk]]) promotional link - **2026-10-23 08:26:46 UTC** · [Jcuhfehl](https://en.wikipedia.org/wiki/User:Jcuhfehl) · -395 bytes mw-manual-revert WP:ELNO−2 removedTo help administrators verify the impact, several vendors and devs released free tools during the embargo and after the embargo. - These included Pentest-Tools.com, Aikido, Trend Micro, Astra Security and many others. - **2026-10-23 07:19:28 UTC** · [~2026-56509-37](https://en.wikipedia.org/wiki/User:~2026-56509-37) · +96 bytes mw-reverted Updated the list of testing tools~1 rewordedThese included Aikido, Trend Micro, Astra Security and many others. These included Pentest-Tools.com, Aikido, Trend Micro, Astra Security and many others. - **2026-10-23 07:06:46 UTC** · [~2026-56562-46](https://en.wikipedia.org/wiki/User:~2026-56562-46) · +299 bytes mw-reverted Just added about the free tools made by some vendors to help people detect their exposure+2 addedTo help administrators verify the impact, several vendors and devs released free tools during the embargo and after the embargo. - These included Aikido, Trend Micro, Astra Security and many others. - **2026-10-23 06:59:02 UTC** · [Stormx007](https://en.wikipedia.org/wiki/User:Stormx007) · +133 bytes mw-reverted minor Added link to a testing tool - **2026-10-23 06:27:18 UTC** · [~2026-56643-37](https://en.wikipedia.org/wiki/User:~2026-56643-37) · +0 bytes *(no edit summary)* - **2026-10-23 06:18:48 UTC** · [Daddynnoob](https://en.wikipedia.org/wiki/User:Daddynnoob) · -1 bytes /* Discovery */~1 rewordedThe Cyber Security Agency of Singapore has also urged organizations in Singapore to fix the security flaws. The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws. - **2026-10-23 06:17:08 UTC** · [Daddynnoob](https://en.wikipedia.org/wiki/User:Daddynnoob) · -139 bytes Link edits~5 rewordedFollowing advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. - The UK National Cyber Security Centre released a similar warning, urging organizations to be wary of backdoors. The NCSC released a similar warning, urging organizations to be wary of backdoors. - The Cyber Security Agency of Singapore has also urged organisations in Singapore to fix the security flaws. The Cyber Security Agency of Singapore has also urged organizations in Singapore to fix the security flaws. - Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. - Volunteer Ondřej Surý of the Czech Republic was credited with playing a crucial role automating the necessary patches. Czech volunteer Ondřej Surý was credited with playing a crucial role automating the necessary patches. - **2026-10-23 05:26:57 UTC** · [Milk 'n' Thyme](https://en.wikipedia.org/wiki/User:Milk_'n'_Thyme) · +373 bytes *(no edit summary)* - **2026-10-23 05:11:50 UTC** · [Yeeno](https://en.wikipedia.org/wiki/User:Yeeno) · +489 bytes /* Impact */ Add Canadian gov't+1 addedSome Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyber Security. +ref https://www.cp24.com/news/canada/2026/10/21/canadian-apps-and-governme - **2026-10-23 04:26:09 UTC** · [DRWiki1102](https://en.wikipedia.org/wiki/User:DRWiki1102) · +0 bytes Resolved CS1 error - **2026-10-23 03:47:03 UTC** · [Lemoncaked](https://en.wikipedia.org/wiki/User:Lemoncaked) · +9 bytes minor /* Analysis */ felt that it should be clarified what library was affected~1 rewordedResearchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used by about two-thirds of the web at the time. - **2026-10-23 03:44:56 UTC** · [FromCzech](https://en.wikipedia.org/wiki/User:FromCzech) · +8 bytes minor /* Analysis */ - **2026-10-23 03:43:38 UTC** · [FromCzech](https://en.wikipedia.org/wiki/User:FromCzech) · +81 bytes /* Analysis */ [[MOS:GEO]], ref format~1 rewordedVolunteer Ondřej Surý of Czechia was credited with playing a crucial role automating the necessary patches. Volunteer Ondřej Surý of the Czech Republic was credited with playing a crucial role automating the necessary patches. +ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet- −ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet- - **2026-10-23 03:41:20 UTC** · [ZKang123](https://en.wikipedia.org/wiki/User:ZKang123) · +0 bytes /* Impact */ - **2026-10-23 03:40:40 UTC** · [ZKang123](https://en.wikipedia.org/wiki/User:ZKang123) · +690 bytes /* Impact */ Added Singapore+1 addedThe Cyber Security Agency of Singapore has also urged organisations in Singapore to fix the security flaws. +ref https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-sing +ref https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/ - **2026-10-23 03:04:00 UTC** · [Kencf0618](https://en.wikipedia.org/wiki/User:Kencf0618) · +331 bytes /* Analysis */ Vital role of Ondřej Surý+1 addedVolunteer Ondřej Surý of Czechia was credited with playing a crucial role automating the necessary patches. +ref https://www.theatlantic.com/technology/2026/10/man-who-saved-internet- - **2026-10-23 02:57:35 UTC** · [Johnson524](https://en.wikipedia.org/wiki/User:Johnson524) · +21 bytes Added Commons Category - **2026-10-23 02:41:24 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · -485 bytes /* Patches */ rm unreliable source−ref https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php - **2026-10-23 01:31:35 UTC** · [2k7x](https://en.wikipedia.org/wiki/User:2k7x) · +25 bytes {{start date and age}} - **2026-10-23 01:23:08 UTC** · [XCBRO172](https://en.wikipedia.org/wiki/User:XCBRO172) · +1 bytes minor /* Patches */ ce~1 rewordedThe PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums,in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. - **2026-10-23 00:54:42 UTC** · [Darth Stabro](https://en.wikipedia.org/wiki/User:Darth_Stabro) · +189 bytes minor [[Wikipedia:MOSNUMscript|script]]-assisted date audit and style fixes per [[MOS:NUM]] - **2026-10-23 00:54:27 UTC** · [Darth Stabro](https://en.wikipedia.org/wiki/User:Darth_Stabro) · -1 bytes minor rm extra space - **2026-10-23 00:04:07 UTC** · [Astrohare](https://en.wikipedia.org/wiki/User:Astrohare) · +2 bytes minor Calif discovered the vulnerability on August 1st 2026 (https://calif.io/php2shell/) - **2026-10-22 23:43:29 UTC** · [~2026-56635-78](https://en.wikipedia.org/wiki/User:~2026-56635-78) · +186 bytes /* Patches */ address a missing citation for the timeline+ref https://scherzer.dev/Blog/20261022-php2shell-timeline - **2026-10-22 22:26:46 UTC** · [~2026-56634-11](https://en.wikipedia.org/wiki/User:~2026-56634-11) · +33 bytes /* See also */ don't assume they are related - **2026-10-22 22:11:29 UTC** · [Dialh](https://en.wikipedia.org/wiki/User:Dialh) · +32 bytes /* Impact */ - **2026-10-22 21:49:43 UTC** · [Paprikaiser](https://en.wikipedia.org/wiki/User:Paprikaiser) · -19 bytes /* Patches */ Fixed lint error~1 rewordedThe PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums,in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. - **2026-10-22 20:27:24 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -692 bytes Remove paragraph sourced to social media−1 removedAn analysis by company-data firm Veridion of web technology detections mapped affected PHP version strings to the companies operating the websites, identifying about 7.07 million companies running an affected version, most of them with fewer than 50 employees; a further 21.9 million companies used PHP without exposing a version and were not counted. −ref https://www.linkedin.com/pulse/php2shell-we-traced-7-million-potential - **2026-10-22 20:26:06 UTC** · [Grimes2](https://en.wikipedia.org/wiki/User:Grimes2) · -5 bytes minor Replaced [[Wikipedia:VisualEditor/Named references|VE ref names]] using [[User:Nardog/RefRenamer|RefRenamer]] - **2026-10-22 20:24:44 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -49 bytes I don't think this needs to be it's own section at this point−1 removed, ~1 rewordedThe New York Times covered the event on 22 October. - They said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk. Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk. - **2026-10-22 18:42:03 UTC** · [RoySmith](https://en.wikipedia.org/wiki/User:RoySmith) · +536 bytes /* Analysis */ NY Times coverage+2 addedThe New York Times covered the event on 22 October. - They said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk. +ref https://www.nytimes.com/2026/10/22/technology/what-is-php-vulnerabilit - **2026-10-22 18:25:11 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +1,090 bytes The references were broken because a closing quote mark was removed, not because of the details. Restore quotes for subscription-locked article per [[WP:FQ]] since "the source is not easily accessible" - **2026-10-22 18:16:57 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +0 bytes fix reference name - **2026-10-22 18:15:11 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +0 bytes /* Impact */ Let's not take up 80% of the width of the article - **2026-10-22 17:41:03 UTC** · [Nosferattus](https://en.wikipedia.org/wiki/User:Nosferattus) · -29 bytes Removing commercial spam trying to sell security services related to PHP2Shell - **2026-10-22 16:59:55 UTC** · [Saratoga18](https://en.wikipedia.org/wiki/User:Saratoga18) · +4 bytes /* Analysis */ sourced to same Veridion citation - **2026-10-22 16:58:39 UTC** · [Quindraco](https://en.wikipedia.org/wiki/User:Quindraco) · +0 bytes /* Discovery */~1 rewordedThe vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026; and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. - **2026-10-22 16:28:54 UTC** · [Ataaras](https://en.wikipedia.org/wiki/User:Ataaras) · +119 bytes minor Image added. - **2026-10-22 16:13:35 UTC** · [Maxeto0910](https://en.wikipedia.org/wiki/User:Maxeto0910) · -5 bytes /* */ unnecessary in infobox - **2026-10-22 16:13:20 UTC** · [Maxeto0910](https://en.wikipedia.org/wiki/User:Maxeto0910) · -1 bytes /* */ no sentence - **2026-10-22 15:42:37 UTC** · [Phoenix](https://en.wikipedia.org/wiki/User:Phoenix) · +37 bytes citation needed - **2026-10-22 15:14:00 UTC** · [Kencf0618](https://en.wikipedia.org/wiki/User:Kencf0618) · +4 bytes /* Impact */ Prosody & encyclopedic tone~1 rewordedParts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous online commerce sites. - **2026-10-22 14:56:24 UTC** · [Marnanel](https://en.wikipedia.org/wiki/User:Marnanel) · +228 bytes /* top */link CVEs+ref https://www.cve.org/CVERecord?id=CVE-2026-109618 +ref https://www.cve.org/CVERecord?id=CVE-2026-109619 - **2026-10-22 14:53:23 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · +41 bytes minor Links added - **2026-10-22 13:49:29 UTC** · [~2026-56519-53](https://en.wikipedia.org/wiki/User:~2026-56519-53) · +1 bytes /* */ - **2026-10-22 13:30:28 UTC** · [TheRaknok](https://en.wikipedia.org/wiki/User:TheRaknok) · +4 bytes minor Fixed grammar, italic~1 rewordedResearchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time. - **2026-10-22 12:18:25 UTC** · [BwDraco](https://en.wikipedia.org/wiki/User:BwDraco) · +2 bytes minor Wording~1 rewordedResearchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2 thirds of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time. - **2026-10-22 11:35:46 UTC** · [Celjski Grad](https://en.wikipedia.org/wiki/User:Celjski_Grad) · -10 bytes mw-rollback minor [[WP:CVPI|Interceptor]]: Reverting non-constructive edits by [[Special:Contributions/~2026-56473-52|~2026-56473-52]]~1 rewordedAn emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. hi thomas An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. - **2026-10-22 11:33:21 UTC** · [~2026-56473-52](https://en.wikipedia.org/wiki/User:~2026-56473-52) · +10 bytes mw-reverted *(no edit summary)*~1 rewordedAn emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. hi thomas - **2026-10-22 11:31:43 UTC** · [Pigsonthewing](https://en.wikipedia.org/wiki/User:Pigsonthewing) · -3 bytes /* */ ce~1 rewordedPHP2Shell is a set of two high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). - **2026-10-22 11:29:49 UTC** · [SoyUnEditorRandom](https://en.wikipedia.org/wiki/User:SoyUnEditorRandom) · +5 bytes mw-undo Undid revision [[Special:Diff/1381424661|1381424661]] by [[Special:Contributions/~2026-56484-56|~2026-56484-56]] ([[User talk:~2026-56484-56|talk]])~1 rewordedResearchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2/3 of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2 thirds of the web at the time. - **2026-10-22 11:23:53 UTC** · [~2026-56484-56](https://en.wikipedia.org/wiki/User:~2026-56484-56) · -5 bytes mw-reverted /* Analysis */ spelling~1 rewordedResearchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2 thirds of the web at the time. Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2/3 of the web at the time. - **2026-10-22 11:12:29 UTC** · [Rich Smith](https://en.wikipedia.org/wiki/User:Rich_Smith) · -437 bytes *(no edit summary)* - **2026-10-22 11:11:34 UTC** · [SoyUnEditorRandom](https://en.wikipedia.org/wiki/User:SoyUnEditorRandom) · -27 bytes /* Discovery */ - **2026-10-22 11:10:08 UTC** · [Rich Smith](https://en.wikipedia.org/wiki/User:Rich_Smith) · -256 bytes /* Discovery */ Fix ref, maybe - **2026-10-22 10:56:44 UTC** · [Awtistik Dev](https://en.wikipedia.org/wiki/User:Awtistik_Dev) · +637 bytes minor Added company-level exposure figures; I work at Veridion (COI).+1 addedAn analysis by company-data firm Veridion of web technology detections mapped affected PHP version strings to the companies operating the websites, identifying about 7.07 million companies running an affected version, most of them with fewer than 50 employees; a further 21.9 million companies used PHP without exposing a version and were not counted. +ref https://www.linkedin.com/pulse/php2shell-we-traced-7-million-potential - **2026-10-22 10:06:34 UTC** · [Dare2Leap](https://en.wikipedia.org/wiki/User:Dare2Leap) · +2 bytes minor Improve formatting - **2026-10-22 09:49:33 UTC** · [~2026-56578-19](https://en.wikipedia.org/wiki/User:~2026-56578-19) · +342 bytes /* Patches */ Add HN post via Wayback Machine link+ref https://news.ycombinator.com/item?id=50167754 - **2026-10-22 09:19:12 UTC** · [98uwd](https://en.wikipedia.org/wiki/User:98uwd) · +75 bytes minor Add links, format days DMY as per the note−1 removed, ~2 reworded17, 2026, in MadPot telemetry, four days before public disclosure. - Both vulnerabilities were published through GitHub security advisories on 21 October at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. - Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure. - **2026-10-22 09:15:04 UTC** · [Osarius](https://en.wikipedia.org/wiki/User:Osarius) · +9 bytes minor clean up - **2026-10-22 08:29:17 UTC** · [Salmon Of Ignorance](https://en.wikipedia.org/wiki/User:Salmon_Of_Ignorance) · +165 bytes added release date to 5.4~1 rewordedPHP versions as early as 5.4 are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. PHP versions as early as 5.4 (released in 2012) are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. +ref https://www.php.net/releases/index.php - **2026-10-22 08:17:16 UTC** · [~chenniest](https://en.wikipedia.org/wiki/User:~chenniest) · -9 bytes minor *(no edit summary)* - **2026-10-22 08:13:42 UTC** · [~chenniest](https://en.wikipedia.org/wiki/User:~chenniest) · -19 bytes minor *(no edit summary)* - **2026-10-22 08:12:06 UTC** · [~2026-56496-69](https://en.wikipedia.org/wiki/User:~2026-56496-69) · -7 bytes mw-manual-revert done - **2026-10-22 08:11:28 UTC** · [~2026-56496-69](https://en.wikipedia.org/wiki/User:~2026-56496-69) · +7 bytes mw-reverted sd - **2026-10-22 08:03:55 UTC** · [~2026-56733-82](https://en.wikipedia.org/wiki/User:~2026-56733-82) · +0 bytes PHP 8.4 instead of PHP 8.8~1 rewordedAn emergency patch for versions 8.2, 8.3, 8.8 and 8.5 and details about the vulnerabilities were released the following day. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. - **2026-10-22 07:34:30 UTC** · [~2026-56504-79](https://en.wikipedia.org/wiki/User:~2026-56504-79) · -1 bytes *(no edit summary)*~1 rewordedCommentary in the Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, receieved "billions" in investment. Commentary in the Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment. - **2026-10-22 07:27:44 UTC** · [Martsniez](https://en.wikipedia.org/wiki/User:Martsniez) · +35 bytes Important to note that versions prior to 8 are not patched.~1 rewordedAn emergency patch and details about the vulnerabilities were released the following day. An emergency patch for versions 8.2, 8.3, 8.8 and 8.5 and details about the vulnerabilities were released the following day. - **2026-10-22 07:18:45 UTC** · [2kbfloppadisk](https://en.wikipedia.org/wiki/User:2kbfloppadisk) · +4 bytes minor /* Analysis */ wl - **2026-10-22 07:09:18 UTC** · [2kbfloppadisk](https://en.wikipedia.org/wiki/User:2kbfloppadisk) · +28 bytes minor /* Analysis */ cleanup~1 rewordedCommentary in the Guardian also noted that the PHP Foundation only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which were credited with helping discover the vulnerability, receieved "billions" in investment. Commentary in the Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, receieved "billions" in investment. - **2026-10-22 07:07:45 UTC** · [2kbfloppadisk](https://en.wikipedia.org/wiki/User:2kbfloppadisk) · +1,100 bytes add analysis section+2 addedResearchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about 2 thirds of the web at the time. - Commentary in the Guardian also noted that the PHP Foundation only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which were credited with helping discover the vulnerability, receieved "billions" in investment. +ref https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai +ref https://www.theguardian.com/technology/2026/oct/22/what-is-php-compute - **2026-10-22 07:05:02 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · +1 bytes test - **2026-10-22 07:03:10 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · +1 bytes test - **2026-10-22 07:00:59 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · -3 bytes ce~1 rewordedAn emergency patch and details about the vulnerabilities were released on the following day. An emergency patch and details about the vulnerabilities were released the following day. - **2026-10-22 07:00:40 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · -56 bytes ce~1 rewordedPHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, know under Common Vulnerabilities and Exposures IDs CVE-2026-109618 and CVE-2026-109619, that allow remote code execution (RCE). PHP2Shell is a set of two high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). - **2026-10-22 06:57:01 UTC** · [~2026-56223-90](https://en.wikipedia.org/wiki/User:~2026-56223-90) · -1 bytes grammafr fix~1 rewordedPHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, known under Common Vulnerabilities and Exposures IDs CVE-2026-109618 and CVE-2026-109619, that allow remote code execution (RCE). PHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, know under Common Vulnerabilities and Exposures IDs CVE-2026-109618 and CVE-2026-109619, that allow remote code execution (RCE). - **2026-10-22 06:39:26 UTC** · [~2026-56496-69](https://en.wikipedia.org/wiki/User:~2026-56496-69) · -10 bytes mw-manual-revert *(no edit summary)* - **2026-10-22 06:38:01 UTC** · [~2026-56496-69](https://en.wikipedia.org/wiki/User:~2026-56496-69) · +10 bytes mw-reverted sweet32 too - **2026-10-22 05:22:09 UTC** · [Yedaman54](https://en.wikipedia.org/wiki/User:Yedaman54) · +79 bytes *(no edit summary)* - **2026-10-22 05:07:02 UTC** · [ShadowLancer](https://en.wikipedia.org/wiki/User:ShadowLancer) · -51 bytes /* Discovery */ clean up language, clarify finer points from the listed sources+1 added, −1 removedPHP versions as early as 5.4 are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. - PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time because it was not thought that an exploit—software that actually uses the security hole to gain access—would be feasible. - **2026-10-22 04:46:48 UTC** · [TAKAHASHI Shuuji](https://en.wikipedia.org/wiki/User:TAKAHASHI_Shuuji) · +2 bytes minor /* Impact */ for better readability, split single large paragraph into three paragraphs (about php ecosystem, about governmental agency, and about temporary shut down of websites) - **2026-10-22 04:42:41 UTC** · [TAKAHASHI Shuuji](https://en.wikipedia.org/wiki/User:TAKAHASHI_Shuuji) · -5 bytes minor remove an extra space. remove a duplicated wikilink - **2026-10-22 04:39:16 UTC** · [Merlin04](https://en.wikipedia.org/wiki/User:Merlin04) · +71 bytes /* Discovery */ Add Wiz corporate structure information~1 rewordedThe vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026; and the Israeli–American cloud security company Wiz, Inc. The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026; and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. - **2026-10-22 04:35:53 UTC** · [Merlin04](https://en.wikipedia.org/wiki/User:Merlin04) · +121 bytes /* Discovery */ ce, clarify Calif researcher LLM use+1 added, ~1 rewordedAustin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability. - The two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli–American cloud security company Wiz, Inc. The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026; and the Israeli–American cloud security company Wiz, Inc. - **2026-10-22 04:32:53 UTC** · [TAKAHASHI Shuuji](https://en.wikipedia.org/wiki/User:TAKAHASHI_Shuuji) · +70 bytes /* External links */ update php announcement link to latest one. add wiz announcement too. avoid deprecated url template usage (ref. [[Template:URL#Parm2]]) - **2026-10-22 04:19:58 UTC** · [Merlin04](https://en.wikipedia.org/wiki/User:Merlin04) · +67 bytes /* Discovery */ Clarify Wiz AI use+1 added, −1 removedWiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research. - To help discover the bug, Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas were used. - **2026-10-22 04:09:07 UTC** · [Merlin04](https://en.wikipedia.org/wiki/User:Merlin04) · -4 bytes /* Discovery */ ce+1 added, −1 removedA PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized. - A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and inasmuch as a specific exploit had not yet been discovered, the work to resolve it was not completed. - **2026-10-22 02:57:15 UTC** · [Kencf0618](https://en.wikipedia.org/wiki/User:Kencf0618) · +6 bytes /* Discovery */ Prosody and nuance~1 rewordedA PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and since a specific exploit had not yet been discovered, the work to resolve it was not completed. A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and inasmuch as a specific exploit had not yet been discovered, the work to resolve it was not completed. - **2026-10-22 02:55:57 UTC** · [Kencf0618](https://en.wikipedia.org/wiki/User:Kencf0618) · +7 bytes /* Discovery */ Prosody and nuance; WP:MDASH works better than parentheses here~1 rewordedPHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit (software that actually uses the security hole to gain access) would be feasible. PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time because it was not thought that an exploit—software that actually uses the security hole to gain access—would be feasible. - **2026-10-22 02:21:51 UTC** · [~2026-56527-79](https://en.wikipedia.org/wiki/User:~2026-56527-79) · +512 bytes /* Patches */ Important earlier wild date reported by AWS+2 addedAmazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. - 17, 2026, in MadPot telemetry, four days before public disclosure. +ref https://aws.amazon.com/blogs/security/amazon-threat-intelligence-ident - **2026-10-22 02:18:10 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -126 bytes Undid revision [[Special:Diff/1381382832|1381382832]] by [[Special:Contributions/~2026-56060-32|~2026-56060-32]] ([[User talk:~2026-56060-32|talk]]) No strong ties to British English.~1 rewordedParts of the Japanese internet also went offline, including Cygames franchises such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, fansites, government agencies, and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites. - **2026-10-22 02:17:51 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · -169 bytes *(no edit summary)* - **2026-10-22 02:13:57 UTC** · [~2026-56060-32](https://en.wikipedia.org/wiki/User:~2026-56060-32) · +126 bytes *(no edit summary)*~1 rewordedParts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites. Parts of the Japanese internet also went offline, including Cygames franchises such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, fansites, government agencies, and many online commerce sites. - **2026-10-22 02:07:52 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +42 bytes Calif is involved in php2shell.com as well, no need to list them separately in the infobox. - **2026-10-22 01:48:39 UTC** · [Thuyhung2112](https://en.wikipedia.org/wiki/User:Thuyhung2112) · -517 bytes remove duplicated citation - **2026-10-22 01:39:54 UTC** · [Mr. Lechkar](https://en.wikipedia.org/wiki/User:Mr._Lechkar) · +232 bytes Tagged [[WP:DUPREF|duplicate citations]] using [[User:Polygnotus/DuplicateReferences|DuplicateReferences]] - **2026-10-22 01:10:12 UTC** · [~2026-56346-31](https://en.wikipedia.org/wiki/User:~2026-56346-31) · -3 bytes reformat the website lists - **2026-10-22 01:07:30 UTC** · [~2026-56346-31](https://en.wikipedia.org/wiki/User:~2026-56346-31) · +38 bytes Attribute to Calif who was the first team that found php2shell, and link to their website. - **2026-10-22 00:36:14 UTC** · [Dare2Leap](https://en.wikipedia.org/wiki/User:Dare2Leap) · -7 bytes minor /* Impact */ Fix author name - **2026-10-22 00:35:22 UTC** · [Dare2Leap](https://en.wikipedia.org/wiki/User:Dare2Leap) · -114 bytes /* Discovery */ Remove non-confirming citation - **2026-10-22 00:34:24 UTC** · [Dare2Leap](https://en.wikipedia.org/wiki/User:Dare2Leap) · +599 bytes /* Discovery */ Add method of discovery+1 addedTo help discover the bug, Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas were used. - **2026-10-22 00:33:02 UTC** · [Fgnievinski](https://en.wikipedia.org/wiki/User:Fgnievinski) · +25 bytes /* Patches */ - **2026-10-22 00:30:16 UTC** · [AlexChillOut](https://en.wikipedia.org/wiki/User:AlexChillOut) · +85 bytes the sources don't mention Wiz at all (unless I missed it somehow), and I can't seem to find anything other than them buying the domain. - **2026-10-22 00:23:50 UTC** · [Panamitsu](https://en.wikipedia.org/wiki/User:Panamitsu) · -4 bytes minor [[MOS:OVERLINK]] - **2026-10-22 00:23:11 UTC** · [Panamitsu](https://en.wikipedia.org/wiki/User:Panamitsu) · -4 bytes minor [[MOS:OVERLINK]] - **2026-10-22 00:21:42 UTC** · [Dare2Leap](https://en.wikipedia.org/wiki/User:Dare2Leap) · +440 bytes /* Impact */ Add Internet Archive+1 addedThe Internet Archive briefly shut down to fix the issue. +ref https://www.afr.com/world/north-america/websites-go-dark-as-ai-discove - **2026-10-22 00:17:24 UTC** · [Gabldotink](https://en.wikipedia.org/wiki/User:Gabldotink) · -5 bytes minor /* top */[[MOS:CURLY]] - **2026-10-22 00:12:34 UTC** · [Dare2Leap](https://en.wikipedia.org/wiki/User:Dare2Leap) · +0 bytes /* Patches */ Prioritize secondary citations - **2026-10-22 00:09:39 UTC** · [Dare2Leap](https://en.wikipedia.org/wiki/User:Dare2Leap) · -236 bytes mw-undo Undid revision [[Special:Diff/1381372239|1381372239]] by [[Special:Contributions/Dare2Leap|Dare2Leap]] ([[User talk:Dare2Leap|talk]]) Only supports part of the sentence - **2026-10-22 00:08:56 UTC** · [Dare2Leap](https://en.wikipedia.org/wiki/User:Dare2Leap) · +236 bytes mw-reverted /* Patches */ Add citation - **2026-10-21 23:50:59 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -482 bytes use non-primary source - **2026-10-21 23:13:40 UTC** · [~2026-56359-71](https://en.wikipedia.org/wiki/User:~2026-56359-71) · -292 bytes *(no edit summary)*−ref https://www.thedigitalforensics.com/infosec/php2shell-ai-didnt-find-th - **2026-10-21 23:13:10 UTC** · [~2026-55697-37](https://en.wikipedia.org/wiki/User:~2026-55697-37) · +3 bytes Fixed link - **2026-10-21 23:12:10 UTC** · [~2026-55697-37](https://en.wikipedia.org/wiki/User:~2026-55697-37) · +16 bytes Fixed link−ref https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two - **2026-10-21 23:08:54 UTC** · [~2026-56359-71](https://en.wikipedia.org/wiki/User:~2026-56359-71) · +292 bytes *(no edit summary)*+ref https://www.thedigitalforensics.com/infosec/php2shell-ai-didnt-find-th - **2026-10-21 23:06:21 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · -47 bytes /* See also */ no rogue agents were involved in discovering this - **2026-10-21 23:05:29 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · +1 bytes /* Impact */ past tense~1 rewordedApproximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts are widespread. Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread. - **2026-10-21 23:04:36 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · -197 bytes combine duplicate references - **2026-10-21 22:50:16 UTC** · [Fgnievinski](https://en.wikipedia.org/wiki/User:Fgnievinski) · +39 bytes *(no edit summary)*+1 added, −1 removedPHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, known under Common Vulnerabilities and Exposures IDs CVE-2026-109618 and CVE-2026-109619, that allow remote code execution (RCE). - CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two high-impact vulnerabilities in PHP versions 5.4–8.5 that allow remote code execution (RCE). - **2026-10-21 22:35:27 UTC** · [~2026-56182-50](https://en.wikipedia.org/wiki/User:~2026-56182-50) · +47 bytes *(no edit summary)* - **2026-10-21 22:13:34 UTC** · [Regulov](https://en.wikipedia.org/wiki/User:Regulov) · +2 bytes minor /* Discovery */~1 rewordedThe two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. The two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli–American cloud security company Wiz, Inc. - **2026-10-21 21:50:16 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · +97 bytes mw-undo Undid revision [[Special:Diff/1381357570|1381357570]] by [[Special:Contributions/Spinarak|Spinarak]] ([[User talk:Spinarak|talk]]) [[WP:BOLDly]] reverting, given that the examples are things that you would, in all likelihood, not associate with PHP, and go beyond the “government websites” examples we have in the rest of the section~1 rewordedParts of the Japanese internet also went offline, including videogames and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites. - **2026-10-21 21:44:35 UTC** · [Spinarak](https://en.wikipedia.org/wiki/User:Spinarak) · -97 bytes mw-reverted /* Impact */ more concise: not necessary to give examples of Japanese videogames~1 rewordedParts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites. Parts of the Japanese internet also went offline, including videogames and many online commerce sites. - **2026-10-21 21:30:42 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +25 bytes clarify that PHP doesn't "host" cPanel, it's just bundled with it~1 rewordedPHP is also bundled with vendor appliances, hosting control panels such as cPanel and Plesk, and some Windows applications. PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications. - **2026-10-21 21:26:57 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -43 bytes /* Discovery */ not needed since a secondary source is also supplied here - **2026-10-21 21:26:23 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +43 bytes /* Discovery */ This source doesn't support the "decades" claim, just the 2024 one. - **2026-10-21 21:02:39 UTC** · [HouseBlaster](https://en.wikipedia.org/wiki/User:HouseBlaster) · -1 bytes /* Impact */ fix space+1 added, −1 removed, ~1 rewordedParts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and many online commerce sites. - Re:Dive, and many online commerce sites. - The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. - **2026-10-21 20:59:41 UTC** · [Suntooooth](https://en.wikipedia.org/wiki/User:Suntooooth) · -243 bytes /* Patches */ Removed "at this point in time" sentence that 1. was referenced to a primary source, and 2. would be outdated quickly−1 removedAt this point in time Amazon (AWS) have not released a patch for AL2023. −ref https://explore.alas.aws.amazon.com/CVE-2026-109618.html - **2026-10-21 20:44:14 UTC** · [मल्ल](https://en.wikipedia.org/wiki/User:मल्ल) · -540 bytes /* Impact */ non-primary sourcing+1 added, −1 removed, ~1 rewordedRe:Dive, and many online commerce sites. - Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasy XIV, and many online commerce sites. - The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! +ref https://mashable.com/tech/php-vulnerability-websites-offline-affected- −ref https://diff.wikimedia.org/2026/10/21/impact-of-php-vulnerabilities-on −ref https://na.finalfantasyxiv.com/lodestone/news/detail/682d63eac6bb6c380 −ref https://umamusume.jp/news/detail?id=3523 - **2026-10-21 20:41:56 UTC** · [2kbfloppadisk](https://en.wikipedia.org/wiki/User:2kbfloppadisk) · -52 bytes minor /* Impact */ overlinked - **2026-10-21 20:40:13 UTC** · [2kbfloppadisk](https://en.wikipedia.org/wiki/User:2kbfloppadisk) · +546 bytes /* Impact */ Expanding article+1 addedThe UK National Cyber Security Centre released a similar warning, urging organizations to be wary of backdoors. +ref https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-compute - **2026-10-21 20:31:39 UTC** · [~2026-56491-19](https://en.wikipedia.org/wiki/User:~2026-56491-19) · +243 bytes /* Patches */+1 addedAt this point in time Amazon (AWS) have not released a patch for AL2023. +ref https://explore.alas.aws.amazon.com/CVE-2026-109618.html - **2026-10-21 20:31:27 UTC** · [Pcuser42](https://en.wikipedia.org/wiki/User:Pcuser42) · -2 bytes /* Patches */ Consistently use DMY formats~1 rewordedThe PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. - **2026-10-21 19:59:30 UTC** · [Agnuse13](https://en.wikipedia.org/wiki/User:Agnuse13) · +0 bytes minor *(no edit summary)* - **2026-10-21 19:57:51 UTC** · [Agnuse13](https://en.wikipedia.org/wiki/User:Agnuse13) · +8 bytes minor *(no edit summary)* - **2026-10-21 19:56:46 UTC** · [Agnuse13](https://en.wikipedia.org/wiki/User:Agnuse13) · +432 bytes Added a key additional set of vulnerabilities for the impact+1 addedPHP is also bundled with vendor appliances, hosting control panels such as cPanel and Plesk, and some Windows applications. +ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil - **2026-10-21 19:28:14 UTC** · [Beland](https://en.wikipedia.org/wiki/User:Beland) · +112 bytes linking and grammar and de-jargon a bit~3 rewordedPHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit would be feasible. PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit (software that actually uses the security hole to gain access) would be feasible. - The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept video mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. - PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo after development platform Chainguard released patched versions of the software early, allowing attackers to determine what code had been changed. Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed. - **2026-10-21 19:25:39 UTC** · [Novixoxoxo](https://en.wikipedia.org/wiki/User:Novixoxoxo) · +12 bytes *(no edit summary)*~1 rewordedCVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4–8.5 that allow remote code execution (RCE). CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two high-impact vulnerabilities in PHP versions 5.4–8.5 that allow remote code execution (RCE). - **2026-10-21 19:05:16 UTC** · *anonymous editor* · +44 bytes Add current event - **2026-10-21 18:40:47 UTC** · [~2026-56142-23](https://en.wikipedia.org/wiki/User:~2026-56142-23) · +281 bytes /* Discovery */ added reference to official php foundation blog about the history of the discovery+ref https://thephp.foundation/blog/2026/10/21/todays-php-security-release- - **2026-10-21 18:37:06 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · +5 bytes /* */ some changes to an occurence of an en-dash~1 rewordedCVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 – 8.5 that allow remote code execution (RCE). CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4–8.5 that allow remote code execution (RCE). - **2026-10-21 18:31:56 UTC** · [PhotographyEdits](https://en.wikipedia.org/wiki/User:PhotographyEdits) · -64 bytes no current event anymore: patches released, websites back online - **2026-10-21 18:29:00 UTC** · [Rtrb](https://en.wikipedia.org/wiki/User:Rtrb) · +1 bytes minor added oxford comma~1 rewordedParts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasy XIV and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasy XIV, and many online commerce sites. - **2026-10-21 18:20:26 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -37 bytes mw-undo Undid revision [[Special:Diff/1381333092|1381333092]] by [[Special:Contributions/XTheBedrockX|XTheBedrockX]] ([[User talk:XTheBedrockX|talk]]) This is not a controversy, and only peripheral Wikipedia services were affected - **2026-10-21 18:10:41 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · +414 bytes re-add {{[[Template:add Unreliable source|add Unreliable source]]}} templates for "The Hacker News" citations [removed in [[Special:Diff/1381327424]] by [[User:Ahecht]] • that edit's summary does not acknowledge the removal, so it likely has been removed accidentally] - **2026-10-21 18:08:23 UTC** · [XTheBedrockX](https://en.wikipedia.org/wiki/User:XTheBedrockX) · +37 bytes mw-reverted added [[Category:Wikipedia controversies]] using [[WP:HC|HotCat]] - **2026-10-21 17:59:42 UTC** · [Rtrb](https://en.wikipedia.org/wiki/User:Rtrb) · +203 bytes /* Impact */ added japanese govt. advisory + fixed citation+1 addedThe Japanese National Cybersecurity Office advised PHP users to immediately update their systems. - **2026-10-21 17:48:55 UTC** · [Rtrb](https://en.wikipedia.org/wiki/User:Rtrb) · +25 bytes minor /* Impact */ fixed citation error - **2026-10-21 17:38:20 UTC** · [Rtrb](https://en.wikipedia.org/wiki/User:Rtrb) · +482 bytes /* Impact */ added NSA citation and partial quote+ref https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release - **2026-10-21 17:37:47 UTC** · [~2026-56411-51](https://en.wikipedia.org/wiki/User:~2026-56411-51) · -5 bytes /* Patches */ removed the extraneous "by" and adjusted the flow~1 rewordedThe PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a video of a proof-of-concept mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept video mistakenly released by Calif. - **2026-10-21 17:31:32 UTC** · [Aidenzdavis](https://en.wikipedia.org/wiki/User:Aidenzdavis) · -3 bytes minor Fixed a small typo~1 rewordedThe PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a video of a proof-of-concept by mistakenly released by Calif. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a video of a proof-of-concept mistakenly released by Calif. - **2026-10-21 17:30:42 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -248 bytes Remove commercial source−ref https://sansec.io/research/php2shell - **2026-10-21 17:28:40 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +0 bytes /* Patches */ move ref to the correct place - **2026-10-21 17:27:24 UTC** · [Red Director](https://en.wikipedia.org/wiki/User:Red_Director) · +39 bytes ref author - **2026-10-21 17:26:29 UTC** · [Ceratius](https://en.wikipedia.org/wiki/User:Ceratius) · +344 bytes minor /* Impact */~1 rewordedParts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasy XIV and many online commerce sites. +ref https://na.finalfantasyxiv.com/lodestone/news/detail/682d63eac6bb6c380 - **2026-10-21 17:22:37 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +228 bytes /* Patches */ add+1 added, −1 removed, ~1 rewordedPoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo after development platform Chainguard released patched versions of the software early, allowing attackers to determine what code had been changed. - PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo. - The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and was confirmed by the X account of cybersecurity company watchTowr labs. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker News forums, in a post on X by cybersecurity company watchTowr labs, and in a video of a proof-of-concept by mistakenly released by Calif. - **2026-10-21 17:18:08 UTC** · [~2026-56305-56](https://en.wikipedia.org/wiki/User:~2026-56305-56) · +1 bytes fix typo~1 rewordedA PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and since a specific explot had not yet been discovered, the work to resolve it was not completed. A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and since a specific exploit had not yet been discovered, the work to resolve it was not completed. - **2026-10-21 17:16:31 UTC** · [Chino O'Chénelle](https://en.wikipedia.org/wiki/User:Chino_O'Chénelle) · +181 bytes minor /* Impact */ Added citations confirming Umamusume: Pretty Derby went offline for updating PHP.+ref https://umamusume.jp/news/detail?id=3523 - **2026-10-21 17:15:04 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -64 bytes /* Discovery */ add information on 2024 discovery, re-order+1 added, ~2 rewordedA PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team could not reach consensus of how to fix the issue, and since a specific explot had not yet been discovered, the work to resolve it was not completed. - The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. The two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. - PHP versions as early as 5.4 are affected, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit would be feasible. PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit would be feasible. - **2026-10-21 17:14:14 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · -2 bytes /* */ use {{[[Template:Flatlist|Flatlist]]}} instead of {{[[Template:Plain list|Plain list]]}} for "Discoverer" entries in infobox [less empty space with a flatlist than a plainlist] - **2026-10-21 17:11:21 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · +414 bytes tag citations to "The Hacker News" (not the forum named "Hacker News") as possibly unreliable [uses AI for images, so likely also uses AI for text • very-rough consensus of unreliability, per [[WP:NPPSG]]] - **2026-10-21 17:06:08 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +24 bytes /* Discovery */ Clarify on the timeline here. The official PHP post doesn't agree with the claim of decades earlier, and PHP 5.4 was only released 14 years ago.+1 added, −1 removedPHP versions as early as 5.4 are affected, and while this type of bug had been identified as an area of concern decades before, no action was taken at the time as it was not thought that an exploit would be feasible. - PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades before, it was not fixed at the time as it was not thought that an exploit would be feasible. - **2026-10-21 17:02:57 UTC** · [Rtrb](https://en.wikipedia.org/wiki/User:Rtrb) · -52 bytes removed inline link: citation already has this url - **2026-10-21 17:01:45 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -29 bytes /* Discovery */ replace self-published source+ref https://thenextweb.com/news/php-foundation-structural-failure-2024-fla −ref https://openai.com/index/coordinated-disclosure-of-critical-vulnerabil - **2026-10-21 16:54:23 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · +34 bytes minor Edited external link to be date-specific. - **2026-10-21 16:53:17 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +0 bytes /* Patches */ move ref - **2026-10-21 16:52:00 UTC** · [QuillQuasar](https://en.wikipedia.org/wiki/User:QuillQuasar) · +38 bytes French outage was Interior Ministry sites per Reuters; fix Reuters and NCSC cites; tag Umamusume~1 rewordedFollowing advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. - **2026-10-21 16:51:12 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -6 bytes /* Impact */ rm unnecessary pipe - **2026-10-21 16:50:27 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +0 bytes minor /* Discovery */ fix - **2026-10-21 16:50:02 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -14 bytes minor /* Discovery */ unnecessary pipe - **2026-10-21 16:49:17 UTC** · [QuillQuasar](https://en.wikipedia.org/wiki/User:QuillQuasar) · +821 bytes Add exploitation status per watchTowr and NBC; add BleepingComputer cite for Cloudflare+1 addedSecurity firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency (CISA) said it had not observed exploitation as of the same day. +ref https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ +ref https://www.bleepingcomputer.com/news/security/php-ships-emergency-pat - **2026-10-21 16:48:27 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +2 bytes fix {{subref}} - **2026-10-21 16:47:59 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +271 bytes add cite+ref https://www.nytimes.com/2026/09/08/us/politics/calif-ai-worm-wechat-ha - **2026-10-21 16:46:30 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · +26 bytes Links - **2026-10-21 16:46:06 UTC** · [QuillQuasar](https://en.wikipedia.org/wiki/User:QuillQuasar) · +769 bytes Restore Ahecht's WSJ quotes and wording, lost in my earlier edit+1 added, −1 removedPHP versions as early as 5.4 are affected, and while the security flaw had been identified decades before, it was not fixed at the time as it was not thought that an exploit would be feasible. - PHP versions as early as 5.4 are affected, and the underlying flaws had gone undetected in PHP's code for more than a decade. - **2026-10-21 16:42:52 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · +4 bytes minor Added a link - **2026-10-21 16:42:07 UTC** · [QuillQuasar](https://en.wikipedia.org/wiki/User:QuillQuasar) · +283 bytes Add patched version numbers and PHP's mitigation advice; tag uncited timestamp+1 added, ~1 rewordedTemporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice. - The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5. The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12). - **2026-10-21 16:40:57 UTC** · [QuillQuasar](https://en.wikipedia.org/wiki/User:QuillQuasar) · -455 bytes Discovery: cite August 2026 date to Sansec; correct flaw age per BBC and Reuters; tag one claim+1 added, ~1 rewordedPHP versions as early as 5.4 are affected, and the underlying flaws had gone undetected in PHP's code for more than a decade. - The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades before, it was not fixed at the time as it was not thought that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. +ref https://sansec.io/research/php2shell - **2026-10-21 16:40:09 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +726 bytes add quotes~1 rewordedThe vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades earlier, it was not fixed at the time as it was not thought that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades before, it was not fixed at the time as it was not thought that an exploit would be feasible. - **2026-10-21 16:39:05 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · -92 bytes /* Impact */ Not sure we need the 4chan screenshot here, the Phab screenshot already works very well as a visual aid, else this start turning into a gallery of maintenance notices - **2026-10-21 16:36:36 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · +18 bytes minor Link added - **2026-10-21 16:35:21 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · -3 bytes minor Grammar changes.~1 rewordedParts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby and Shadowverse: Worlds Beyond, and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, and many online commerce sites. - **2026-10-21 16:34:53 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · +7 bytes *(no edit summary)*~1 rewordedCVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 –8.5 that allow remote code execution. CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 – 8.5 that allow remote code execution (RCE). - **2026-10-21 16:34:03 UTC** · [~2026-56304-51](https://en.wikipedia.org/wiki/User:~2026-56304-51) · +92 bytes /* Impact */ - **2026-10-21 16:30:00 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -12 bytes use {{url}} - **2026-10-21 16:28:58 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +4 bytes restore link to [[GitHub]] - **2026-10-21 16:28:37 UTC** · [IngeniousPachyderm](https://en.wikipedia.org/wiki/User:IngeniousPachyderm) · -1 bytes /* Impact */ updated to present tense~1 rewordedApproximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread. Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts are widespread. - **2026-10-21 16:28:17 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · +54 bytes adding website for exploit - **2026-10-21 16:26:05 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -29 bytes Remove [[WP:OVERLINK]] and inline external links, c/e~1 rewordedFollowing an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. - **2026-10-21 16:23:42 UTC** · [~2026-56304-51](https://en.wikipedia.org/wiki/User:~2026-56304-51) · +6 bytes /* Impact */ Proper spelling - **2026-10-21 16:20:00 UTC** · [NightWolf1223](https://en.wikipedia.org/wiki/User:NightWolf1223) · -23 bytes /* External links */ not a stub - **2026-10-21 16:16:42 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · +200 bytes Citing versions, Wiz states that 5.4 was the first version affected, NIST and PHP only listed 8.2-8.5 due to those getting patches~3 rewordedCVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5–8 that allow remote code execution. CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 –8.5 that allow remote code execution. - Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. - Parts of the Japanese internet also went offline, including the online card game Shadowverse: Worlds Beyond and many online commerce sites. Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby and Shadowverse: Worlds Beyond, and many online commerce sites. +ref https://www.wiz.io/blog/php2shell-php-rce - **2026-10-21 16:15:49 UTC** · [LucasBrown](https://en.wikipedia.org/wiki/User:LucasBrown) · +2 bytes minor [[MOS:DASHVAR]]~1 rewordedCVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5-8 that allow remote code execution. CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5–8 that allow remote code execution. - **2026-10-21 16:14:13 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · +4 bytes minor One link added - **2026-10-21 16:13:00 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · +36 bytes minor More links added. - **2026-10-21 16:09:35 UTC** · [Beland](https://en.wikipedia.org/wiki/User:Beland) · -4 bytes /* Patches */ grammar~1 rewordedCloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. - **2026-10-21 16:08:16 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +27 bytes add cite - **2026-10-21 16:06:23 UTC** · [TheXug](https://en.wikipedia.org/wiki/User:TheXug) · -3 bytes minor /* Impact */ Fixed grammar~1 rewordedFollowing an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. - **2026-10-21 16:05:41 UTC** · [SeaSpace](https://en.wikipedia.org/wiki/User:SeaSpace) · +1 bytes minor typo fix~1 rewordedThe vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades earlier, it was not fixed at the time as it was not thought that an exploit would be feasible. - **2026-10-21 16:04:42 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · +125 bytes minor Added links to other articles where useful. - **2026-10-21 16:03:52 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -35 bytes /* Discovery */ c/e~1 rewordedThe vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as PHP 5.4, all the way through to PHP 8, are affected, and while the security flaw has been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible. - **2026-10-21 16:03:12 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -14 bytes /* Discovery */ not need to credit that to Wiz~1 rewordedThe vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected, and while the security flaw has been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. PHP versions as early as PHP 5.4, all the way through to PHP 8, are affected, and while the security flaw has been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible. - **2026-10-21 16:02:45 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +673 bytes /* Discovery */ add~1 rewordedThe vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project, and by the Israeli-American cloud security company Wiz, Inc. According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected. The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project in August 2026, and by the Israeli-American cloud security company Wiz, Inc. According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected, and while the security flaw has been identified decades earlier, it was not fixed at the time as it was not though that an exploit would be feasible. +ref https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two +ref https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-u −ref https://www.wiz.io/blog/php2shell-php-rce - **2026-10-21 15:58:06 UTC** · [4Seasons4](https://en.wikipedia.org/wiki/User:4Seasons4) · -4 bytes minor Removed unnecessary softlink. - **2026-10-21 15:56:16 UTC** · [Bnuuy](https://en.wikipedia.org/wiki/User:Bnuuy) · -10 bytes minor /* Impact */ rephrase~1 rewordedThe US National Security Agency recommended that websites go offline if they're not able to immediately update. The US National Security Agency recommended that websites go offline if unable to update immediately. - **2026-10-21 15:55:11 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +17 bytes /* See also */ add [[Heartbleed]], given as a similar level of vulnerability by Volker Dusch as quoted in the WSJ article - **2026-10-21 15:54:26 UTC** · [Bnuuy](https://en.wikipedia.org/wiki/User:Bnuuy) · +17 bytes adjust lede~1 rewordedCVE-2026-109618 and CVE-2026-109619 are two vulnerabilities in PHP that allow remote code execution and are together known as PHP2Shell. CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5-8 that allow remote code execution. - **2026-10-21 15:52:15 UTC** · [Xymph](https://en.wikipedia.org/wiki/User:Xymph) · +0 bytes minor update anchor to php advisory+ref https://www.php.net/archive/2026.php#2026-10-21-5 −ref https://www.php.net/archive/2026.php#2026-10-21-1 - **2026-10-21 15:51:44 UTC** · [Benjamin Loison](https://en.wikipedia.org/wiki/User:Benjamin_Loison) · +1 bytes minor /* Impact */ Correct a typo~1 rewordedFollowing an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school comunication platform, all Finnish government public-facing web services, and French local government administration websites. Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and French local government administration websites. - **2026-10-21 15:50:42 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +37 bytes /* Impact */ add cite - **2026-10-21 15:49:55 UTC** · [GreenRunner0](https://en.wikipedia.org/wiki/User:GreenRunner0) · +0 bytes minor /* Impact */~1 rewordedFollowing an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school comunication platform, all Finnish government public-facing web services, and French local gobernment administration websites. Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school comunication platform, all Finnish government public-facing web services, and French local government administration websites. - **2026-10-21 15:49:09 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +426 bytes /* Impact */ add+1 addedThe US National Security Agency recommended that websites go offline if they're not able to immediately update. +ref https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-cons - **2026-10-21 15:46:39 UTC** · [GreenRunner0](https://en.wikipedia.org/wiki/User:GreenRunner0) · +448 bytes /* Impact */ Japan+1 addedParts of the Japanese internet also went offline, including the online card game Shadowverse: Worlds Beyond and many online commerce sites. +ref https://www.itmedia.co.jp/news/article/2610/21/2000002472/ - **2026-10-21 15:45:43 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · +87 bytes /* Discovery */ mark OpenAI and Wiz's citations as possibly [[WP:SPS|self-published]] - **2026-10-21 15:45:20 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +358 bytes /* Impact */ add~1 rewordedApproximately 69% of websites use PHP, so the potential impacts were widespread. Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread. - **2026-10-21 15:39:47 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +861 bytes /* Impact */ update+2 added, ~1 rewordedApproximately 69% of websites use PHP, so the potential impacts were widespread. - The Wikimedia Foundation shut down many of their supporting services, and forum sites 4Chan and Something Awful went offline. - Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending. Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school comunication platform, all Finnish government public-facing web services, and French local gobernment administration websites. +ref https://diff.wikimedia.org/2026/10/21/impact-of-php-vulnerabilities-on - **2026-10-21 15:34:25 UTC** · [Zenphia1](https://en.wikipedia.org/wiki/User:Zenphia1) · +0 bytes mw-undo Undid revision [[Special:Diff/1381316773|1381316773]] by [[Special:Contributions/Zenphia1|Zenphia1]] ([[User talk:Zenphia1|talk]]) - **2026-10-21 15:34:08 UTC** · [Zenphia1](https://en.wikipedia.org/wiki/User:Zenphia1) · +0 bytes mw-reverted *(no edit summary)* - **2026-10-21 15:33:33 UTC** · [Zenphia1](https://en.wikipedia.org/wiki/User:Zenphia1) · +11 bytes *(no edit summary)* - **2026-10-21 15:30:38 UTC** · [Graham87](https://en.wikipedia.org/wiki/User:Graham87) · -1 bytes minor /* Patches */ grammar~1 rewordedThe PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and were confirmed by the X account of cybersecurity company watchTowr labs. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and was confirmed by the X account of cybersecurity company watchTowr labs. - **2026-10-21 15:28:59 UTC** · [Graham87](https://en.wikipedia.org/wiki/User:Graham87) · +1 bytes minor typo~1 rewordedAn emergency patch and details about the vulnerabilites were released on the following day. An emergency patch and details about the vulnerabilities were released on the following day. - **2026-10-21 15:28:07 UTC** · [GreenRunner0](https://en.wikipedia.org/wiki/User:GreenRunner0) · +579 bytes /* Impact */ UK advice too~1 rewordedFollowing an advice from CERT-EU, many organizations across Europe took their websites offline as a precaution while the patches were pending. Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending. +ref https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-upd +ref https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php - **2026-10-21 15:27:48 UTC** · [Paoepaoanida](https://en.wikipedia.org/wiki/User:Paoepaoanida) · +0 bytes /* */ fixed grammar~1 rewordedAn emergency patch and details about the vulnerabilites was released on the following day. An emergency patch and details about the vulnerabilites were released on the following day. - **2026-10-21 15:25:57 UTC** · [Zenphia1](https://en.wikipedia.org/wiki/User:Zenphia1) · +0 bytes *(no edit summary)*~1 rewordedAn emergency patch and details about the vulnerability were released on the following day. An emergency patch and details about the vulnerabilites was released on the following day. - **2026-10-21 15:25:32 UTC** · [Zenphia1](https://en.wikipedia.org/wiki/User:Zenphia1) · -19 bytes *(no edit summary)*~1 rewordedThe existence of the vulnerability was publicly announced on 20 October 2026. Their existence was publicly announced on 20 October 2026. - **2026-10-21 15:23:51 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · -297 bytes /* Discovery */ remove "The Hacker News" source [very-rough consensus of unreliability at [[WP:NPPSG]] • uses AI for its article images, thus likely also uses AI for its article text]−ref https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two - **2026-10-21 15:22:59 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +20 bytes /* Patches */ re-add source - **2026-10-21 15:21:49 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · -236 bytes /* Patches */ Rm claim, not clear how much those companies had contributed to the actual patches and it's sourced to a press release anyways~1 rewordedThe maintainers of PHP worked with companies including Wiz, Cloudflare, and OpenAI to develop and release patched version of PHP 8.2, 8.3, 8.4, and 8.5. The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5. - **2026-10-21 15:19:41 UTC** · [Pieceofmetalwork](https://en.wikipedia.org/wiki/User:Pieceofmetalwork) · +1,253 bytes Impact+1 addedFollowing an advice from CERT-EU, many organizations across Europe took their websites offline as a precaution while the patches were pending. +ref https://www.bbc.com/news/articles/cmly0lg3w5x2o +ref https://www.brusselstimes.com/belgium/2371464/major-websites-go-offlin +ref https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-ma - **2026-10-21 15:13:01 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · -62 bytes /* Patches */ remove citation tagged as failed verification [tagged by me in a previous edit • to avoid tag-clutter] - **2026-10-21 15:11:00 UTC** · [Ashmoo](https://en.wikipedia.org/wiki/User:Ashmoo) · +2 bytes /* Patches */ - **2026-10-21 15:09:37 UTC** · [Ashmoo](https://en.wikipedia.org/wiki/User:Ashmoo) · +26 bytes *(no edit summary)* - **2026-10-21 15:05:10 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · +118 bytes /* */ mark Wiz/Cloudflare/OpenAI-collaboration statement with tags - **2026-10-21 14:54:46 UTC** · [Ashmoo](https://en.wikipedia.org/wiki/User:Ashmoo) · -32 bytes source doesn't indicate this is notable. reinclude with exactly why it is notable.~1 rewordedIt is notable for the fact that the PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and were confirmed by the X account of cybersecurity company watchTowr labs. The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and were confirmed by the X account of cybersecurity company watchTowr labs. - **2026-10-21 14:52:47 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +605 bytes Add+1 added, ~1 rewordedIt is notable for the fact that the PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and were confirmed by the X account of cybersecurity company watchTowr labs. - It is notable for the fact that the PHP maintainers announced the update early and before release, encouraging users to prepare and update as soon as the patch was released. The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released. +ref https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two +ref https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php −ref https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell - **2026-10-21 14:52:22 UTC** · [Ashmoo](https://en.wikipedia.org/wiki/User:Ashmoo) · +5 bytes *(no edit summary)*~1 rewordedThe existence of the vulnerability was publicly announced on 20 October. The existence of the vulnerability was publicly announced on 20 October 2026. - **2026-10-21 14:51:19 UTC** · [Rchard2scout](https://en.wikipedia.org/wiki/User:Rchard2scout) · +1 bytes minor Grammar fix ("was" -> "were" in lead)~1 rewordedAn emergency patch and details about the vulnerability was released on the following day. An emergency patch and details about the vulnerability were released on the following day. - **2026-10-21 14:42:05 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +914 bytes update+3 added, −1 removedThe vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" project, and by the Israeli-American cloud security company Wiz, Inc. According to Wiz, versions as early as PHP 5.4, all the way through to PHP 8, are affected. - The maintainers of PHP worked with companies including Wiz, Cloudflare, and OpenAI to develop and release patched version of PHP 8.2, 8.3, 8.4, and 8.5. - Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life. - According to discoverer Wiz, Inc, versions as early as PHP 5.4, all the way through to PHP 8, are affected. +ref https://openai.com/index/coordinated-disclosure-of-critical-vulnerabil - **2026-10-21 14:41:01 UTC** · [Nemoralis](https://en.wikipedia.org/wiki/User:Nemoralis) · +34 bytes mw-undo Undid revision [[Special:Diff/1381309962|1381309962]] by [[Special:Contributions/Ahecht|Ahecht]] ([[User talk:Ahecht|talk]]); [[WP:REVEXP]] - **2026-10-21 14:32:50 UTC** · [PhotographyEdits](https://en.wikipedia.org/wiki/User:PhotographyEdits) · +39 bytes add links - **2026-10-21 14:29:08 UTC** · [Fregatatta](https://en.wikipedia.org/wiki/User:Fregatatta) · +4 bytes minor add wiktionary link - **2026-10-21 14:27:24 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · -34 bytes mw-undo mw-reverted Undid revision [[Special:Diff/1381309826|1381309826]] by [[Special:Contributions/Nemoralis|Nemoralis]] ([[User talk:Nemoralis|talk]]) - **2026-10-21 14:26:23 UTC** · [Streetr4](https://en.wikipedia.org/wiki/User:Streetr4) · -109 bytes mw-undo minor Undid revision [[Special:Diff/1381309714|1381309714]] by [[Special:Contributions/~2026-56204-88|~2026-56204-88]] ([[User talk:~2026-56204-88|talk]]): Speculation−1 removedMany websites using PHP have shut down already, and future shutdowns are expected until a fix is released. - **2026-10-21 14:25:59 UTC** · [Nemoralis](https://en.wikipedia.org/wiki/User:Nemoralis) · +34 bytes mw-reverted add website - **2026-10-21 14:25:28 UTC** · [Nintendofan885](https://en.wikipedia.org/wiki/User:Nintendofan885) · +9 bytes should be 'Phabricator instance' - **2026-10-21 14:24:53 UTC** · [~2026-56204-88](https://en.wikipedia.org/wiki/User:~2026-56204-88) · +109 bytes mw-reverted added a short line mentioning website shutdowns+1 addedMany websites using PHP have shut down already, and future shutdowns are expected until a fix is released. - **2026-10-21 14:22:22 UTC** · [ItzSwirlz](https://en.wikipedia.org/wiki/User:ItzSwirlz) · +18 bytes discoverer - **2026-10-21 14:15:09 UTC** · [PhotographyEdits](https://en.wikipedia.org/wiki/User:PhotographyEdits) · +5 bytes improve first sentence+1 added, −1 removedCVE-2026-109618 and CVE-2026-109619 are two vulnerabilities in PHP that allow remote code execution and are together known as PHP2Shell. - PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a remote code execution vulnerability reported in October 2026 in the common web scripting language PHP. - **2026-10-21 14:08:53 UTC** · [~2026-56383-01](https://en.wikipedia.org/wiki/User:~2026-56383-01) · -111 bytes addressed + no more need - **2026-10-21 14:02:05 UTC** · [Ahecht](https://en.wikipedia.org/wiki/User:Ahecht) · +224 bytes update link+ref https://www.php.net/archive/2026.php#2026-10-21-1 - **2026-10-21 13:59:18 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · -25 bytes more precise term~1 rewordedPHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a arbitrary code execution vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a remote code execution vulnerability reported in October 2026 in the common web scripting language PHP. - **2026-10-21 13:58:43 UTC** · [Gemdation](https://en.wikipedia.org/wiki/User:Gemdation) · +219 bytes minor Ars Tech down... so sad - **2026-10-21 13:56:51 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · -78 bytes Wiz seems to repeat the 9.2 figure−1 removedWiz Research who discovered it said the severity reached 10. - **2026-10-21 13:53:57 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · -282 bytes *(no edit summary)*+2 added, −1 removed, ~1 rewordedThe existence of the vulnerability was publicly announced on 20 October. - An emergency patch and details about the vulnerability was released on the following day. - The existence of the vulnerability was announced on 20 October and an emergency patch was released on 21 October at 14:00 UTC together with all other information about the vulnerability. - Early reporting suggest versions as early as PHP 5, all the way through to PHP 8, are affected. According to discoverer Wiz, Inc, versions as early as PHP 5.4, all the way through to PHP 8, are affected. −ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil - **2026-10-21 13:53:29 UTC** · [Warp03](https://en.wikipedia.org/wiki/User:Warp03) · +4 bytes *(no edit summary)*~1 rewordedBoth vulnerabilities were published through GitHub security advisories on 21 October at 15:34, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. Both vulnerabilities were published through GitHub security advisories on 21 October at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. - **2026-10-21 13:53:02 UTC** · [Warp03](https://en.wikipedia.org/wiki/User:Warp03) · +527 bytes *(no edit summary)*+1 addedBoth vulnerabilities were published through GitHub security advisories on 21 October at 15:34, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. +ref https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp +ref https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w - **2026-10-21 13:48:24 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · +255 bytes restore accidentally deletion+1 addedWiz Research who discovered it said the severity reached 10. +ref https://www.wiz.io/blog/php2shell-php-rce - **2026-10-21 13:46:43 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · -286 bytes fix has been released+1 added, −1 removed, ~4 rewordedEarly reporting suggest versions as early as PHP 5, all the way through to PHP 8, are affected. - While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. - PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a arbitrary code execution vulnerability reported in October 2026 in the common web scripting language PHP. - The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, but Wiz Research who discovered it said the severity reached 10. The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. - Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on 21 October at 14:00 UTC together with all other information about the vulnerability. The existence of the vulnerability was announced on 20 October and an emergency patch was released on 21 October at 14:00 UTC together with all other information about the vulnerability. - PoCs, write-ups, and partial mitigations started circulating on the Internet. PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo. −ref https://www.wiz.io/blog/php2shell-php-rce - **2026-10-21 13:45:10 UTC** · [Ms7821](https://en.wikipedia.org/wiki/User:Ms7821) · +259 bytes Add Wiz cite~1 rewordedThe vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers. The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, but Wiz Research who discovered it said the severity reached 10. +ref https://www.wiz.io/blog/php2shell-php-rce - **2026-10-21 13:42:45 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · -3 bytes *(no edit summary)* - **2026-10-21 13:42:33 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · +44 bytes *(no edit summary)* - **2026-10-21 13:26:40 UTC** · [Crtbob](https://en.wikipedia.org/wiki/User:Crtbob) · +598 bytes mw-rollback minor [[WP:CVPI|Interceptor]]: Reverting unexplained deletion by [[Special:Contributions/~2026-56282-91|~2026-56282-91]]~1 rewordedCloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation againsT Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. +ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st +ref https://x.com/dok2001/status/2112811965735202970 - **2026-10-21 13:26:24 UTC** · [~2026-56282-91](https://en.wikipedia.org/wiki/User:~2026-56282-91) · -598 bytes mw-reverted *(no edit summary)*~1 rewordedCloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation againsT −ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st −ref https://x.com/dok2001/status/2112811965735202970 - **2026-10-21 13:26:17 UTC** · [Crtbob](https://en.wikipedia.org/wiki/User:Crtbob) · +581 bytes mw-rollback minor [[WP:CVPI|Interceptor]]: Reverting unexplained deletion by [[Special:Contributions/~2026-56282-91|~2026-56282-91]]+1 added, ~1 rewordedWhile the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. - PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common webh 8. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. +ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two - **2026-10-21 13:25:57 UTC** · [~2026-56282-91](https://en.wikipedia.org/wiki/User:~2026-56282-91) · -581 bytes mw-reverted *(no edit summary)*−1 removed, ~1 rewordedWhile the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. - PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common webh 8. −ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two - **2026-10-21 13:05:23 UTC** · [Ms7821](https://en.wikipedia.org/wiki/User:Ms7821) · +318 bytes minor Fix forward cite+ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two - **2026-10-21 13:04:29 UTC** · [Laura240406](https://en.wikipedia.org/wiki/User:Laura240406) · +21 bytes link - **2026-10-21 13:02:03 UTC** · [PhotographyEdits](https://en.wikipedia.org/wiki/User:PhotographyEdits) · +114 bytes add external link of the announcement - **2026-10-21 13:00:41 UTC** · [PhotographyEdits](https://en.wikipedia.org/wiki/User:PhotographyEdits) · +2 bytes expand abbreviation~1 rewordedCloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary WAF rules as an attempted stopgap mitigation against the vulnerability. Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability. - **2026-10-21 12:58:16 UTC** · [Ms7821](https://en.wikipedia.org/wiki/User:Ms7821) · -394 bytes Undo https://en.wikipedia.org/w/index.php?title=PHP2Shell&diff=prev&oldid=1381288860, which is not matched by citations or searches~1 rewordedThe vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers. −ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two - **2026-10-21 12:55:59 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · -34 bytes /* */ [[WP:BOLD]]-ly revise Phabricator-image caption - **2026-10-21 12:34:50 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · +184 bytes Adding screenshot of the Phabricator as a visual aid for sites being disabled during the pre-patch chaos - **2026-10-21 12:28:54 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · -1 bytes /* */ some MOS changes ([[MOS:BADDATE]], [[MOS:RANGE]])~2 rewordedWhile the information about the vulnerability has been embargoed until 21nd October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. - Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October at 14:00 UTC together with all other information about the vulnerability. Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on 21 October at 14:00 UTC together with all other information about the vulnerability. - **2026-10-21 12:24:19 UTC** · [Warp03](https://en.wikipedia.org/wiki/User:Warp03) · +72 bytes *(no edit summary)*~2 rewordedWhile the information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While the information about the vulnerability has been embargoed until 21nd October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. - Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October at 14:00 UTC. Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October at 14:00 UTC together with all other information about the vulnerability. +ref https://www.php.net/archive/2026.php#2026-10-20-1 −ref https://www.php.net/archive/2026.php - **2026-10-21 12:19:29 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · +272 bytes better source found (PC Gamer)+ref https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-st - **2026-10-21 11:43:33 UTC** · [Mlkj](https://en.wikipedia.org/wiki/User:Mlkj) · -144 bytes eMudhra incident is unrelated, except by date - **2026-10-21 11:38:35 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · +222 bytes {{better source needed}} - **2026-10-21 11:37:37 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · -1 bytes ce - **2026-10-21 11:37:23 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · +29 bytes wl - **2026-10-21 11:24:41 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · +379 bytes *(no edit summary)*+1 addedCloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary WAF rules as an attempted stopgap mitigation against the vulnerability. +ref https://x.com/dok2001/status/2112811965735202970 - **2026-10-21 11:24:38 UTC** · [~2026-56327-82](https://en.wikipedia.org/wiki/User:~2026-56327-82) · +25 bytes eMudhra isn't really related to this incident without clarification - **2026-10-21 11:23:09 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · +18 bytes see also - **2026-10-21 11:22:52 UTC** · [PhotographyEdits](https://en.wikipedia.org/wiki/User:PhotographyEdits) · +23 bytes minor +{{Software-eng-stub}} using [[User:SD0001/StubSorter|StubSorter]] - **2026-10-21 11:22:32 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · +4 bytes *(no edit summary)*~1 rewordedWhile information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While the information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. - **2026-10-21 11:21:23 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · -1 bytes wrong date~1 rewordedWhile information about the vulnerability has been embargoed until 22nd November at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. - **2026-10-21 11:20:44 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · +129 bytes *(no edit summary)*~2 rewordedUnconfirmed reports claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. While information about the vulnerability has been embargoed until 22nd November at 15:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. - Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October 2026 at 14:00 UTC. Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October at 14:00 UTC. - **2026-10-21 11:20:28 UTC** · [~2026-56187-17](https://en.wikipedia.org/wiki/User:~2026-56187-17) · +229 bytes Known state of public PoCs, mitigations and write-ups+1 addedPoCs, write-ups, and partial mitigations started circulating on the Internet. +ref https://jackalsyn.com/posts/php-up-2026.html - **2026-10-21 11:10:15 UTC** · [PhotographyEdits](https://en.wikipedia.org/wiki/User:PhotographyEdits) · +131 bytes add eMudhra see also link - **2026-10-21 11:01:34 UTC** · [~2026-56352-28](https://en.wikipedia.org/wiki/User:~2026-56352-28) · +31 bytes Changed statement about remote code execution to include 'unconfirmed reports claim that' to better reflect source cited.~1 rewordedIt allows arbitrary code execution on any website that runs PHP versions 5 through 8. Unconfirmed reports claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8. - **2026-10-21 10:55:11 UTC** · [Strongshorts](https://en.wikipedia.org/wiki/User:Strongshorts) · +11 bytes /* */ Added clarification that 9.2 is a Critical vulnerability~1 rewordedThe vulnerability was rated 9.2 out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. - **2026-10-21 10:48:42 UTC** · [Largely Legible Layman](https://en.wikipedia.org/wiki/User:Largely_Legible_Layman) · +0 bytes moved citation outside punctuation - **2026-10-21 10:11:35 UTC** · [Tenshi Hinanawi](https://en.wikipedia.org/wiki/User:Tenshi_Hinanawi) · -8 bytes [[WP:NOELBODY]]~1 rewordedPHP2Shell (' and ') is a vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. - **2026-10-21 10:05:36 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · +1 bytes *(no edit summary)* - **2026-10-21 10:03:31 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · +395 bytes clarify~1 rewordedThe vulnerability was rated 9.2 out of 10 under CVSS v4.0. The vulnerability was rated 9.2 out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. +ref https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two - **2026-10-21 09:39:59 UTC** · [Padgriffin](https://en.wikipedia.org/wiki/User:Padgriffin) · +182 bytes *(no edit summary)* - **2026-10-21 09:35:37 UTC** · [Lordseriouspig](https://en.wikipedia.org/wiki/User:Lordseriouspig) · +8 bytes Add CVE link~1 rewordedPHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. PHP2Shell (' and ') is a vulnerability reported in October 2026 in the common web scripting language PHP. - **2026-10-21 09:29:06 UTC** · [Lordseriouspig](https://en.wikipedia.org/wiki/User:Lordseriouspig) · +32 bytes update language used in current template - **2026-10-21 09:24:13 UTC** · [Lordseriouspig](https://en.wikipedia.org/wiki/User:Lordseriouspig) · +30 bytes Added {{[[Template:Current|Current]]}} tag - **2026-10-21 09:21:43 UTC** · [Novem Linguae](https://en.wikipedia.org/wiki/User:Novem_Linguae) · +0 bytes ce - **2026-10-21 08:58:43 UTC** · [~2026-56237-46](https://en.wikipedia.org/wiki/User:~2026-56237-46) · +1 bytes fix typo~1 rewordedPHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in thecommon web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. - **2026-10-21 08:43:17 UTC** · [Ltbdl](https://en.wikipedia.org/wiki/User:Ltbdl) · +93 bytes adding the most important part+1 added, ~1 rewordedIt allows arbitrary code execution on any website that runs PHP versions 5 through 8. - PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in common web scripting language PHP. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in thecommon web scripting language PHP. - **2026-10-21 08:33:38 UTC** · [JackDunnCodes](https://en.wikipedia.org/wiki/User:JackDunnCodes) · +1,223 bytes *(no edit summary)*+3 addedEarly reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for release on the 21st October 2026 at 14:00 UTC. - It is notable for the fact that the PHP maintainers announced the update early and before release, encouraging users to prepare and update as soon as the patch was released. - One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release". +ref https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell +ref https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabil +ref https://www.php.net/archive/2026.php - **2026-10-21 08:27:42 UTC** · [Ljcool2006](https://en.wikipedia.org/wiki/User:Ljcool2006) · +17 bytes *(no edit summary)* - **2026-10-21 08:27:06 UTC** · [Ljcool2006](https://en.wikipedia.org/wiki/User:Ljcool2006) · +98 bytes *(no edit summary)* - **2026-10-21 08:14:01 UTC** · [LightNightLights](https://en.wikipedia.org/wiki/User:LightNightLights) · +6 bytes /* */ unbold "and" between CVE IDs - **2026-10-21 07:50:23 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · +59 bytes Adding [[Wikipedia:Short description|short description]]: "2026 software security vulnerability" - **2026-10-21 07:50:01 UTC** · [Ca](https://en.wikipedia.org/wiki/User:Ca) · +824 bytes [[WP:AES|←]]Created page with ''''PHP2Shell''' ('''CVE-2026-109618 and CVE-2026-109619''') is a [[Vulnerability (computer security)|vulnerability]] reported in October 2026 in common web scripting language [[PHP]].{{Cite web |last=Goodin |first=Dan |date=2026-10-21 |title=PHP warns it plans to release 2 emergency patches imminently |url=https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/ |access-date=2026-10-21...'+2 addedPHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in common web scripting language PHP. - The vulnerability was rated 9.2 out of 10 under CVSS v4.0. Edit summaries and text are Wikipedia's, CC BY-SA 4.0, by its contributors, shown as text. --- site v0.18.0 · data as of 2026-10-24T16:05Z · vault commit 8c16a64a7cf6 · https://php.oct.2026.newsroom.sgit.ai/wikipedia/php2shell/history/index.html