PHP2Shell: Critical PHP Vulnerabilities

Information current as of 25 October 2026. Security advice changes quickly, so check the official PHP site for updates.

In the third week of October 2026, one of the biggest web security stories in years broke. Two critical flaws in the core of PHP, the programming language behind a huge share of the web, were disclosed and patched in an emergency release. The flaws have been nicknamed PHP2Shell, and they carry another headline detail: artificial intelligence played a major role in finding them. This article explains what happened, how AI is involved and what you should do if your website runs on PHP.

What Is PHP2Shell?

PHP2Shell is the name given to two vulnerabilities in the PHP interpreter, tracked as CVE-2026-109618 and CVE-2026-109619. Both received a severity score of 9.2 out of 10 on the CVSS v4.0 scale, which puts them in the critical category. In simple terms, they can let an attacker who has no account or password run their own code on a vulnerable web server. This is called remote code execution, and it is among the most serious kinds of security flaws.

Security researchers who reproduced the issue reported that normal application-level login protections cannot stop it, because PHP processes the harmful request before the website's own code gets involved.

The Two Flaws in Plain Language

CVE-2026-109618: This relates to how PHP behaves when it runs out of memory while preparing request data. The data can be left partly set up, and PHP's cleanup process may then treat that unreliable data as if it were safe.
CVE-2026-109619: This relates to request-specific information that remains in memory after the space behind it has been freed. A later request handled by the same worker process could then reuse that outdated information.

You do not need to understand the technical detail to act on this. What matters is that both issues sit in PHP itself, not in a single plugin or theme.

Who Is Affected?

Cloud and security vendors reported that a very wide range of versions is exposed, from PHP 5.4 up to 8.5.11. That includes older versions that no longer get regular support. Wiz said PHP powers around 70% of websites worldwide. Content management systems and apps built on PHP, such as WordPress and Drupal, run on top of the language, so they depend on the server's PHP version being patched. Websites on platforms that do not use PHP, including Blogger, are not directly affected by this particular flaw.

Timeline of Events

July 2026: The security firm Calif begins work on the issue, using an OpenAI model, according to OpenAI.
19 August 2026: Wiz Research independently finds the first related vulnerability.
24 August 2026: Wiz reports the flaws to the PHP security team.
17 October 2026: Amazon says its monitoring systems recorded an exploit attempt, four days before public disclosure.
20 October 2026: Details leak online before the coordinated release.
21 October 2026: PHP publishes emergency fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
22 to 23 October 2026: Cloudflare reports attempts rising into the millions, and PHP warns of a separate lower-risk issue, CVE-2026-115560.

How Was AI Involved?

This is what makes PHP2Shell different from earlier big vulnerabilities. According to published accounts, AI models worked alongside human researchers at two separate teams. Calif used OpenAI's GPT-5.6 Sol, and the work was linked to an OpenAI initiative focused on finding and fixing flaws in widely used software. Wiz, a Google-owned security company, used its own tool along with Google's Gemini 4 Argon and GPT-5.6 Sol. Both teams ended up at the same weaknesses without knowing about each other at first.

The PHP Foundation also noted that the number of vulnerability reports it receives has grown sharply as AI-assisted research has spread. Wiz described the discovery as an inflection point for the AI era, because AI makes it easier to find hidden flaws and to turn them into working attacks.

Why This Matters: AI Helps Defenders and Attackers

There are two sides to this story. On the positive side, AI found serious flaws in a heavily used language before most attackers did, and the issue was fixed. On the other side, the same technology can lower the effort needed to build attack code. Security experts quoted in news coverage warned that bugs which were once hard to exploit may become realistic targets. The window between a patch being released and attackers using it is also getting shorter. In this case, exploit attempts started within hours of disclosure, and the leak shortened the time defenders had to prepare.

What You Should Do Now

Check your PHP version. Look in your hosting control panel, or ask your host.
Update to a fixed release. Use 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the newer package from your operating system vendor.
If you are on shared hosting, contact your provider. Many large hosts have already applied the fix, but confirm it.
Replace unsupported versions. If you run PHP 7 or older, plan an upgrade to a supported branch.
Apply recommended interim settings if you cannot patch immediately. Vendors suggested options such as turning off session upload progress, but these only reduce exposure and are not a replacement for updating.
Watch for unusual activity. Unexpected processes started by your web server, new files or sudden traffic spikes deserve attention.
Keep backups. Make sure you have a clean, recent copy of your site and database.

A Third Issue to Know About

On 23 October, PHP published a short notice about another flaw, CVE-2026-115560. It affects only unusual configurations involving sessions, and PHP considers it unlikely in practice. No attacks using it had been reported at the time of writing. The project plans to publish a full advisory with its next routine release, so keep an eye on future updates.

Bigger Lessons

Patch fast. Delay is the biggest risk when a flaw is public.
Know what you run. Many organisations do not have a full list of their PHP installations, including old tools and control panels.
Plan for AI-speed threats. Update schedules measured in weeks may no longer be enough for critical issues.
Use layered defences. Web application firewalls, monitoring and least-privilege settings add protection around the code.

Frequently Asked Questions

Is my WordPress site at risk?

If the server's PHP version is unpatched, yes. Updating WordPress itself is not enough. The PHP version on your hosting must be updated too.

Do I need a password or login to be attacked?

According to researchers, no. That is why the severity is so high.

Does AI make websites less safe?

AI can raise the speed of both attack and defence. The best response is quicker updates and better monitoring.

Disclaimer: This article is for general information and does not replace professional security advice. Always follow guidance from the official PHP project, your hosting provider and a qualified security professional. We do not provide or support exploit code.

Sources and Further Reading

Wiz Research blog, "PHP2Shell: AI uncovers critical RCE vulnerabilities"
Datadog Security Labs, PHP2Shell analysis
Huntress, rapid response article on the leaked PHP vulnerabilities
Google Cloud blog, response to CVE-2026-109618 and CVE-2026-109619
The Hacker News, reports on exploit attempts and CVE-2026-115560
Fortune and NPR coverage of the AI role in the discovery
SiteGround and University of Washington IT notices on patching

Oil Prices Hit a Six-Month High as Strait of Hormuz Tensions Continue

Market snapshot as of 25 October 2026. Prices change daily, so check a live quote before relying on any figure in this article.

Crude oil is climbing again, and the Strait of Hormuz is at the centre of the story. Brent crude, the global benchmark, settled at about $116.72 a barrel on Friday, 23 October, according to Reuters-based market reports. That was a jump of roughly 3% in a single session and the highest settlement since late April. US crude (WTI) closed near $103. The rally comes while attacks on ships around the Strait continue, diplomacy appears stalled, and traders worry that the conflict between the US and Iran could flare up again. Here is what is driving prices and what Me and Market readers should watch.

Where the Hormuz Situation Stands

The Strait of Hormuz is a narrow waterway through which a large share of the world's oil normally travels. Reports say Iran closed it in July, and since then shipping through the area has been disrupted. Traffic has recovered somewhat at times, but it has also dropped sharply after waves of attacks. In early October, record tanker attacks pushed crossings to a two-month low. One tally counts at least 28 attacks on vessels in and around the Strait during October, and other counts differ, but sources agree the attacks are continuing and that damaged tankers have been reported.

In short, the situation is unresolved. Some oil is moving, but the route remains dangerous.

Why Oil Prices Are Rising

1. Continued attacks on tankers

Each new attack raises the cost and risk of moving oil. Shipowners and insurers charge more, some voyages are delayed, and traders add a risk premium to futures prices. A senior energy analyst quoted in recent coverage noted that markets price in stability, not only the volume of oil available. Even when supply looks adequate on paper, fear about the route can keep prices high.

2. Pressure on Saudi export routes

Since the Strait was closed, Saudi Arabia has relied heavily on its East-West pipeline to the Red Sea port of Yanbu, which Aramco's chief executive has said carries about 7 million barrels a day. Over the past few days, the Houthis have claimed attacks on Saudi targets, including Yanbu and the pipeline, while Riyadh says it has intercepted incoming strikes. Any damage to this backup route would tighten supply further, so traders are watching it closely.

3. Fear of renewed fighting

Iranian officials have warned that US warships will not be allowed to get close, and reports say Washington is weighing new action. Brent first crossed $100 in March, during the opening weeks of the war, and peaked at about $126. Markets know that a return to heavy strikes could push prices back toward those levels.

4. Emergency stock releases are running down

In March, International Energy Agency members agreed to release 400 million barrels from emergency reserves. By early October, roughly 325 million barrels had been released, with about 100 million still to come. The agency has said it will not add to the total. As that cushion shrinks, the market has less protection against new shocks.

5. Tight fuel markets

Refineries have been running close to capacity, which can push prices of products like diesel up faster than crude. Higher fuel costs are already showing up in inflation data in some countries. Canada, for instance, reported inflation at 3.1% with fuel oil prices up sharply.

Key Price Levels Traders Are Watching

Traders following Brent are paying attention to a few simple levels. The first is the recent high near $117, which the market has just tested. The second is the peak near $126 from earlier in the conflict, which many see as a major resistance area. The third is the zone around $108 to $112, which some analysts view as a possible support area if prices pull back. These are widely discussed levels and not predictions. Prices can move through any of them quickly when headlines change.

What Forecasters Expect

Forecasts are far apart, which shows how uncertain things are. Goldman Sachs published a December Brent forecast of $90 earlier this month, when prices were lower, so the market is now well above that view. The US Energy Information Administration expects a much lower average price in 2027 than today's level. At the same time, Brent futures for April 2027 are trading above $100, which suggests many traders do not expect a quick return to calm.

What It Could Mean for Indian Markets

India imports most of the crude oil it consumes, so sustained high prices can matter. In general, higher oil tends to widen the import bill, add pressure on the rupee, raise transport and input costs, and keep inflation concerns alive. Sectors such as oil marketing companies, airlines, paints and tyres are often watched closely when crude rises, while some energy producers may benefit. The effect on Nifty and Bank Nifty depends on many other factors as well, so oil is only one piece of the picture.

What to Watch Next

Tanker attack reports and any change in shipping traffic through Hormuz.
Status of Saudi export facilities at Yanbu and along the East-West pipeline.
US and Iran headlines, including any sign of renewed strikes or restarted talks.
The US Federal Reserve meeting on 28 October, since oil prices can influence inflation and interest-rate expectations.
The OPEC+ meeting on 1 November and weekly US inventory data.

Frequently Asked Questions

Is the Strait of Hormuz open?

Some ships are passing, but attacks continue and traffic has been unstable. The situation is not back to normal.

Why do different websites show different Brent prices?

Prices depend on the contract month and the time of the quote. Some sites show the front-month contract and others a later one, so small gaps are normal.

Will oil prices keep rising?

Nobody can say for sure. Prices could drop quickly if tensions ease or climb further if attacks widen. Treat any single forecast with caution.

Does a high oil price always hurt stocks?

Not always. The impact depends on the sector, the speed of the move and other economic factors.

Disclaimer: This article is for educational purposes only and is not investment advice or a recommendation to buy or sell any security or commodity. Commodity and stock markets involve high risk. Please do your own research and consult a qualified financial advisor before making decisions.

Sources and Further Reading

FinanceFeeds market reports on Brent crude, 23 to 25 October 2026
OilPrice.com, "Brent Tops $110 as Tanker Attacks Threaten Persian Gulf Supply"
CNN Business, report on tanker attacks and IEA stock releases, 8 October 2026
Al Jazeera, report on Iran and Strait of Hormuz tensions, 24 October 2026
International Business Times Australia, Strait of Hormuz status update
BigGo Finance, report on Brent above $117

Me and Market

Sunday, 25 October 2026