Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Wikipedia, as a graph / PHP2Shell / Every statement
Every statement in Wikipedia's PHP2Shell article, with its evidence
One statement per sentence of revision 1381798757, in the article's order, each classed by its wording and followed by its references, the capture this site holds of them, and the claims of this site that rest on the same page. Read by a parser (admin/build/wikitext.py), never by a model.
record a number, a date, a version or an identifier, stated plainly stated a plain statement in the article's own voice attributed says a named party said, reported, estimated or believes it quote carries someone's words in quotation marks hedged may, could, reportedly, is believed, estimated to: the article being careful
Lead
- record PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. [2] [3]
- record Their existence was publicly announced on 20 October 2026. [4]Evidence: php.net · Our claims on the same source: disclosure-22oct only-update preannounce-time rce-modphp release-time two-cves-9.2
- hedged An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits could be used. [5]Evidence: php.net · Our claims on the same source: disclosure-22oct only-update preannounce-time rce-modphp release-time two-cves-9.2
- stated PHP is a popular programming language that many website and web application codebases are built upon. Evidence: uncited
- hedged The vulnerabilities are estimated to affect nearly 70% of websites. Evidence: uncited
Discovery
- quote The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. [6] [8]Evidence: cited, not yet captured
- record Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability. [8]Evidence: cited, not yet captured
- record Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research. [27]Evidence: cited, not yet captured
- hedged PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. [7] [31] [8]Evidence: cited, not yet captured
- hedged A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized. [9] [10]
- record The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. [11] [12]Evidence: cited, not yet captured
Patches
- record The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12). [5]Evidence: php.net · Our claims on the same source: disclosure-22oct only-update preannounce-time rce-modphp release-time two-cves-9.2
- record Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life. [5]Evidence: php.net · Our claims on the same source: disclosure-22oct only-update preannounce-time rce-modphp release-time two-cves-9.2
- stated Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice. [5]Evidence: php.net · Our claims on the same source: disclosure-22oct only-update preannounce-time rce-modphp release-time two-cves-9.2
- record Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems. [13] [14] [15] [16] [17]Evidence: PHP PHP · Our claims on the same source: fix-bailout fix-engine four-reporters only-update openai-same-day rce-fpm rce-modphp release-time two-cves-9.2
- hedged Volunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versions from the patched source code so that server administrators could automate deployments without compiling PHP themselves. Evidence: uncited
- attributed In response to claims on X that unpatched older PHP releases left one-third of the internet permanently vulnerable, Surý stated that there were ways to patch and update the older versions as well. [42]Evidence: cited, not yet captured
- stated The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X (formerly Twitter) by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. [18] [8] [9]Evidence: cited, not yet captured
- stated The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released. [5]Evidence: php.net · Our claims on the same source: disclosure-22oct only-update preannounce-time rce-modphp release-time two-cves-9.2
- quote One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release". [19]Evidence: Ars Technica
- stated Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed. [12] [9]Evidence: cited, not yet captured
- record Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure. [20]
- attributed Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall rules as an attempted stopgap mitigation against the vulnerability. [21] [22] [23]Evidence: bleepingcomputer.com
- attributed Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day. [24] [43]Evidence: watchTowr · Our claims on the same source: watchtowr-itw
Impact
- stated The potential impacts of the vulnerability were widespread. Evidence: uncited
- stated Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress.<ref name="Collier2026" details="Citing "></ref> PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications. [25] [26]Evidence: Huntress · Our claims on the same source: huntress-none no-confirmed-compromise pocs-wrong
- stated Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. [27] [25] [28] [29]Evidence: NCSC UK · Our claims on the same source: offline-ncsc
- stated Some Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyber Security. [30]Evidence: cited, not yet captured
- attributed The US National Security Agency recommended that websites go offline if unable to update immediately. [31] [32]Evidence: cited, not yet captured
- stated The NCSC released a similar warning, urging organizations to be wary of backdoors. [33]Evidence: cited, not yet captured
- attributed The Japanese National Cybersecurity Office advised PHP users to immediately update their systems. [37]Evidence: cited, not yet captured
- stated The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws. [34] [35]Evidence: CNA
- stated The Wikimedia Foundation shut down many of their supporting services, and forum sites such as 4chan and Something Awful went offline. [43] [36] [31]Evidence: cited, not yet captured
- stated Several Japanese websites and applications also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous e-commerce sites. [37] [36]Evidence: cited, not yet captured
- stated The Internet Archive briefly shut down to fix the issue. [38]Evidence: cited, not yet captured
Analysis
- attributed Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used by about two-thirds of the web at the time. [39]Evidence: cnn.com
- attributed Commentary in The Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment. [40]Evidence: cited, not yet captured
- quote Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk. [41]Evidence: cited, not yet captured
- stated Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches. [42]Evidence: cited, not yet captured
The text is Wikipedia's, CC BY-SA 4.0, by its contributors.