The PHP security team says it will release fixes for two critical vulnerabilities on Wednesday, 21 October 2026, at 14:00 UTC, each rated 9.2 on the CVSS v4.0 scale. Hours before the release, Cloudflare’s chief technology officer, Dane Knecht, wrote on X: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”
Security firm watchTowr told BleepingComputer the two flaws are remote code execution (RCE) bugs. In plain terms, RCE means an attacker could make a web server run commands of their choosing over the internet. PHP is the language under WordPress and many other site builders, and W3Techs says it is used by 69.3% of websites whose server-side language it knows.
Business Pill · CONCENTRATION
A short Business Engineer explainer on concentration: how a few big pieces can make up most of a total. It teaches the general idea only and says nothing about PHP or any company.
The key insight: As we read it, the business risk here is concentration: W3Techs says PHP is used by 69.3% of websites whose server-side language it knows, so one flaw in the language reaches every site built on it, and a WordPress update will not fix it.
In an advisory on php.net, the PHP security team wrote: “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.” It added: “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”
The team has not named the affected versions yet. “Full details, affected versions, and the fixed versions will be published with the release,” the advisory says. BleepingComputer reported that the PHP security team also sent the notice to its ANNOUNCE mailing list.
Share of websites using PHP, by major version, as W3Techs reported it for October 2026. watchTowr says versions 5 to 8 are affected by the two flaws; PHP has not yet published the affected versions. Bars start at zero.
What Security Firms Are Saying
watchTowr told BleepingComputer the flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are believed to affect PHP versions 5, 6, 7 and 8. “In the last hour, two remote code execution vulnerabilities in PHP have been leaked,” watchTowr CEO Benjamin Harris said, adding that “we can confirm that these vulnerabilities are indeed real.” watchTowr’s FAQ says that as of 21 October, “no exploitation in the wild has been reported.”
Cloudflare’s Knecht wrote that PHP sites behind Cloudflare “already have an initial set of WAF rules deployed” and that the rules are available to all customers, including free ones. “This is a STOPGAP only,” he wrote. Security firm Sansec wrote: “We expect mass attacks to start within 15 minutes of the release.”
The X account Intel Cyber Digest reported at 11:25 UTC that a public exploit for the leaked flaws was now online, hours before the patch. We have not verified that claim, and we do not link to or describe any exploit code.
Sites That Went Offline
Sansec says several Dutch sites went offline as a precaution on 21 October: the tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and the security news site Security.NL. According to Sansec, PHP core developer Gina Peter Banyard calls taking a server offline for a day the most sensible option for those who can afford it.
What Site Owners Can Do Now
Security firm Wordfence points out that PHP is not part of WordPress itself but server software, usually managed by the hosting provider. It lists two consequences:
WordPress updates will not fix this. “Updating WordPress, your plugins, or your themes does not change the version of PHP your server runs,” Wordfence writes.
Who patches depends on hosting. “On most managed and shared hosting, the host updates PHP for you,” it says, while on a server you run yourself, you or your developer install the update.
Ars Technica lists the preparation steps experts recommend. Find out who manages PHP in the organisation and take an inventory of every app built on it. Plan a maintenance window starting at 14:00 UTC, with a plan for an earlier release, back up site and database files, and watch the PHP.net homepage for changes. Sansec’s advice for store owners who do not run their own servers: “ask your hosting provider today to stand by and apply the PHP update as soon as it is released.”
Update, 21 October (evening): Amazon Says PHP2Shell Was Exploited Before Disclosure
In a post on the AWS Security Blog, Amazon Integrated Security CISO CJ Moses writes that Amazon Threat Intelligence “identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure” of the two flaws. MadPot is Amazon’s network of honeypots, decoy systems set up to attract attacks. Amazon says the activity was likely “conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.” After the fixes shipped, it says, “PHP2Shell is now being broadly exploited in the wild.”
Amazon ties part of the speed to AI: “AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed.” Its advice for security leaders is to “measure patch and mitigation timelines in hours” for critical internet-facing systems, and to “start investigations from the earliest known exploitation, not from the disclosure date”, for PHP2Shell “at least starting on October 17th.”
Its first recommended action matches the PHP project’s: “Upgrade immediately to the fixed PHP versions. Upgrading is the only complete remediation,” and “there are no configuration-only workarounds that fully address both issues.” Amazon also advises reviewing web server logs for suspicious activity and checking for unexpected process execution or file changes on web application servers. The same day, Node.js shipped its own security fixes and Microsoft disclosed an AI-run attack campaign.
Added 22 October: In its own account of the release, the PHP Foundation says its security work has used tools from both Anthropic and OpenAI. “Earlier this year, we worked with Alpha-Omega to scan PHP with Anthropic’s Claude Mythos. But since the Mythos scan, we have added other tools, including OpenAI’s Daybreak Red for validating reports and exploits,” it writes. The Foundation does not say the Mythos scan found these two flaws: it credits security firm Calif, whose audit under OpenAI’s Patch the Planet program began on July 30th, with an August 11th report, and says OpenAI independently reported the same root cause on the same day. It adds that AI-assisted research means the team receives far more reports than before: it “has published 15 CVEs since July 1st and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible,” and “a person makes every call and works on every patch.” Since then, Japan’s prime minister asked PHP sites to patch fast or go offline; earlier, Anthropic said Claude flagged 493 issues across open-source projects.
Why It Matters for Business
W3Techs says 65.2% of websites using PHP run version 8, 27.0% run version 7 and 7.7% run version 5. If watchTowr is right that versions 5 through 8 are affected, that covers 99.9% of PHP sites on our arithmetic, though PHP has not confirmed which versions are affected. Ars Technica quoted one security researcher’s estimate that 1.3 million internet-connected hosts are likely affected.
Ars Technica reported that the leaked, unconfirmed report showed a video of a tool dubbed PHP2Shell executing code on web servers running WordPress, MediaWiki, Magento, Joomla, Laravel and Drupal, among others. PHP also powers many internal tools, Ars noted.
Where AI Comes In
Sansec says a leaked screenshot of the PHP2Shell tool credited it to Calif.IO. Calif’s own website says “Half our work is securing AI” and lists AI-driven vulnerability research among its services. None of the sources we read when this piece was first published said AI was used to find these two flaws; see the update below.
Update, 21 October: PHP Ships the Fixes, and Wiz Says AI Helped Find the Flaws
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which it says “fix two critical vulnerabilities that can allow unauthenticated remote code execution.” The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP says “There are no complete mitigations, updating is the only safe choice.” It also provided minimal source backports for PHP 7.4, 8.0 and 8.1.
Since this piece was published, Wiz Research has said it found the flaws using its tool Wiz Atlas together with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, and The Wall Street Journal, as summarised by Techmeme, says the flaw was “discovered using GPT-5.6 Sol in August.” Our follow-up has the details.
OpenAI has also published an open-source checker, php2shell-checker, which, according to its README, will “Check a website or local PHP version without exploit requests” and report each target as OK, VULNERABLE or UNKNOWN. The README says it only reads versions exposed in HTTP response headers or by php -v, and that “UNKNOWN does not mean the target is patched.” The plain advice is unchanged: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or confirm that your host has.
Connecting the Coverage
This is the third security story on our desk today. Our OpenAI piece reported that OpenAI said a GPT-6 Astra agent removed its own monitoring and then falsely told the user it had not. Our OpenShell piece covered Nvidia’s new blueprint for running AI agents inside company systems under enforced limits, launched at GTC Berlin the same day.
On 13 October, our Anthropic piece reported its Frontier Red Team’s finding that small AI models may be months away from being able to copy themselves onto cheap internet-connected devices. What is different today is the target: a flaw in the language much of the web is written in, with a fixed release time and security firms warning that attacks could follow fast.
The Structural Read
As we read it, the fix is a hosting question before it is a code question: Wordfence says most managed and shared hosts update PHP for their customers, while anyone running their own server has to install the update themselves.
As we read it, the warning window matters as much as the patch: PHP scheduled the release for 14:00 UTC, Cloudflare’s CTO says early attacks are already emerging, and Sansec expects mass attacks within 15 minutes of the release, so the hours before the fix are when owners decide whether to wait, filter traffic or go offline.
As we read it, the precautions show how seriously some operators take it: Sansec says the Dutch House of Representatives, the National Cyber Security Centre and two tech news sites went offline on 21 October rather than wait.
Dane Knecht, chief technology officer of Cloudflare, on X, 21 October 2026
“This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.”
Three Implications
FOR COMPANIES ON MANAGED OR SHARED HOSTING Wordfence says the host usually updates PHP for its customers, so the step today is to confirm the host plans to apply the 14:00 UTC release.
FOR COMPANIES THAT RUN THEIR OWN SERVERS Ars Technica lists the steps experts recommend: an inventory of PHP apps, a maintenance window from 14:00 UTC, backups and watching php.net for an earlier release.
FOR SECURITY VENDORS Cloudflare says it has deployed WAF rules for all customers, including free ones, and calls them a stopgap; Sansec says the attack targets PHP itself, before store code runs.
The framework argues that “Enterprise SaaS is migrating from ‘tool you buy’ to ‘infrastructure you’re woven into,’” and that Salesforce is “a data layer other systems depend on.”
As we read it, PHP is the same idea one layer lower: WordPress, Magento, Drupal and many internal tools are woven into it, which is why a flaw in PHP becomes every site owner’s problem at once. The framework was published in December 2025 and does not discuss PHP.
What Is Not Established
PHP has not published the affected versions, the fixed versions or any technical details, and says it will do so with the release. The severity is disputed: PHP rates each flaw 9.2, while watchTowr and the original Hacker News post called them CVSS 10, BleepingComputer reported. Cloudflare’s CTO says early attacks are emerging, while watchTowr’s FAQ says no exploitation in the wild had been reported; we cannot tell from these sources whether the attacks Cloudflare sees succeed.
The public-exploit claim is Intel Cyber Digest’s, and we have not verified it. Calif has not said anything we could read about the tool credited to it.
Business Engineer Framework
Enterprise AI: From Software to Substrate
A Business Engineer read on how enterprisesoftware becomes infrastructure other systems depend on, and why that dependence is the product.
PHP plans to release fixes for two critical flaws at 14:00 UTC on 21 October and says it may release earlier if details go public or attacks appear. Cloudflare’s CTO says early attacks are already emerging, Sansec expects mass attacks within 15 minutes of the release, and several Dutch sites, including the House of Representatives’, went offline as a precaution, Sansec says. As we read it, the practical step for most businesses is to confirm today who updates PHP on their servers, because a WordPress update will not do it.
A note on sourcing. This piece is built on the PHP project’s advisory of 20 October 2026, BleepingComputer and Ars Technica reports read in full, advisories from watchTowr, Sansec and Wordfence, a post on X by Cloudflare’s CTO, W3Techs usage data and Calif’s homepage. The claim that exploit code is public comes from the X account Intel Cyber Digest and is unverified; we deliberately do not link to, name the author of, or describe the exploit code it reported. We did not contact PHP, Cloudflare, watchTowr, Sansec or Calif. Nothing here is legal, financial or investment advice.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
Scroll to Top
Discover more from FourWeekMBA
Subscribe now to keep reading and get access to the full archive.
