Leak forces PHP to ship fixes for 14-year-old PHP2Shell bug a day early

PHP’s maintainers released emergency patches on Wednesday, October 21, 2026, a day before a planned coordinated disclosure, after details of two critical vulnerabilities leaked online. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10, allow remote code execution on unpatched servers; PHP powers about 70% of websites using a known server-side language. Called PHP2Shell, the bugs had existed in PHP for 14 years, according to OpenAI president Greg Brockman, whose company said its models helped find them. Finland, the Netherlands and France took government websites offline as a precaution, while Cloudflare reported attacks and shipped stopgap mitigations.