PHP2Shell (CVE-2026-109618 and CVE-2026-109619): The Flaw Behind Black October

Cloudflare reported a steep curve of exploitation attempts around disclosure:

• Thousands of attempts in the 10 hours before disclosure, so some attackers had the bugs early.
• Tens of thousands after about 45 minutes of public disclosure.
• Hundreds of thousands after two hours, and millions by the time Cloudflare's CEO posted about it.

Governments reacted. The US NSA urged immediate patching or shutting systems down, the UK NCSC advised taking unpatched systems offline if necessary, and some public sector, school and hospital sites were pulled offline as a precaution.

Wiz reported that frontier AI models found the flaws, and OpenAI said one of them was discovered by its GPT-5.6 Sol model. The bugs reportedly sat in the codebase for more than a decade. That is the most important long-term point in this story: automated review can surface old bugs far faster than humans did, and attackers have access to similar tooling.

1. Inventory. Find every PHP runtime, including those inside containers, CMS images and shared hosting.
2. Upgrade to a fixed version listed above. If you cannot, restrict public access or take the service offline.
3. Assume exposure of secrets on any unpatched internet-facing host and rotate database passwords, API keys and tokens.
4. Hunt. Look for new PHP files in upload directories, unexpected web shells, new admin users and outbound connections from web servers.
5. Add a WAF rule as a stopgap, but do not treat it as a fix. Our guide to WAF bypass techniques shows why.