Today, October 21, 2026, Wiz Research disclosed PHP2Shell, two critical vulnerabilities in the core PHP engine (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). These are not application bugs — they exist in PHP itself.
What this means for your business:
If your organization runs WordPress, Drupal, Joomla, or any other PHP-based application, you are potentially exposed. An unauthenticated attacker can remotely execute code on your server and read sensitive process memory — including passwords, tokens, and API keys — without any login credentials.
Every PHP version going back to 5.4 is affected by at least one of these vulnerabilities.
PHP released a security patch today. Southridge Technology is actively assessing exposure across our managed clients and assisting with remediation.
What you should do right now:
- If you manage your own infrastructure, apply the PHP security patch immediately.
- If you are a Southridge Technology managed services client, we are proactively reviewing your environment and will be in touch.
- If you are unsure of your exposure, contact us today — we will help you assess and respond.
This vulnerability also marks a turning point: frontier AI models were used to develop these exploits in a fraction of the time previously required. Complexity is no longer a reliable barrier. This is a moment to ensure your security posture reflects where the threat landscape actually is.
Contact Southridge Technology: [your contact info]
Full advisory: https://www.wiz.io/blog/php2shell-php-rce
#CyberSecurity #PHP2Shell #CriticalVulnerability #ManagedServices #SouthridgeTechnology #InfoSec #RCE
X (Twitter) — Southridge Technology
URGENT: PHP2Shell — Critical RCE vulnerabilities (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) now disclosed. PHP powers 70% of the internet. Every version back to 5.4 is affected. Unauthenticated attackers can execute code remotely on WordPress, Drupal & Joomla.
Patch released today. Update PHP NOW.
AI was used to build these exploits — what used to take months now takes days. Complexity is no longer a security barrier.
Need help? Contact Southridge Technology. https://www.wiz.io/blog/php2shell-php-rce
#PHP2Shell #CyberSecurity #RCE #InfoSec
Facebook — Southridge Technology
IMPORTANT SECURITY ALERT for Our Customers and Community
A critical security vulnerability called PHP2Shell was publicly disclosed today, October 21, 2026, affecting PHP — the programming language that runs approximately 70% of all websites, including WordPress, Drupal, Joomla, and many others.
What does this mean for you?
If your website or business application runs on PHP (which includes most websites), you may be at risk. This vulnerability allows attackers to take control of a server or steal sensitive information without needing a username or password. Every PHP version from the past decade is affected.
The good news: A patch was released today.
The action items:
- Website owners and IT administrators should update PHP to the latest patched version immediately.
- If you are a Southridge Technology customer, we are already working on your behalf to assess and address exposure in your environment.
- If you have questions or are unsure whether you are affected, please contact us directly.
We are here to help. Do not hesitate to reach out to our team.
#CyberSecurity #PHP2Shell #SecurityAlert #SouthridgeTechnology
Instagram — Southridge Technology
SECURITY ALERT: PHP2Shell
Critical vulnerability in PHP — the engine behind 70% of the internet — patched today.
What you need to know:
- CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2)
- Unauthenticated attackers can run code on your server
- WordPress, Drupal, Joomla, and virtually all PHP sites affected
- Every PHP version from the past 10+ years is affected
- Patch released October 21, 2026
If your site runs PHP, update now. Not sure if you are affected? Send us a message — we are here to help.
#PHP2Shell #CyberSecurity #SecurityAlert #SouthridgeTechnology #WebSecurity #Infosec #RCE
@Jairo Romero – Website post please.
Executive Recap: PHP2Shell Critical RCE Vulnerabilities
What Is PHP2Shell?
On October 21, 2026, Wiz Research publicly disclosed PHP2Shell, a set of critical memory-safety vulnerabilities in the core PHP engine — the programming language that powers an estimated 70% of all websites on the internet. The vulnerabilities were assigned two CVEs (CVE-2026-109618 and CVE-2026-109619) with a CVSS severity score reaching 9.2 out of 10.
These are not application-level bugs. The flaws exist in PHP’s core engine itself, meaning every website running on an affected PHP version is at risk regardless of how securely the application on top of it was written.
Which Systems Are Affected?
Every PHP version released over the past decade is affected by at least one of these vulnerabilities, going back to PHP version 5.4. Platforms confirmed to be exploitable include:
- WordPress
- Drupal
- Joomla
- MediaWiki (the software powering Wikipedia)
- Any PHP application running on an unpatched version
What Can an Attacker Do?
Successful exploitation of PHP2Shell allows an unauthenticated attacker to:
- Execute arbitrary code on the affected server (Remote Code Execution)
- Read sensitive data from PHP process memory, including passwords, authentication tokens, API keys, and certificates belonging to other users or the server itself
- Deface websites or take full control of the underlying server
These actions can be performed without any login credentials and, in some cases, with relatively little technical effort.
The Four Core Bugs
CVE-2026-109618: Upload-Progress Unserializer Use-After-Free
PHP’s Session module can decode session data during upload-progress handling before normal initialization. A fatal out-of-memory error can corrupt internal PHP state, leaving stale global pointers. A subsequent request handled by the same PHP worker can reuse that corrupted memory, enabling an attacker to achieve remote code execution on WordPress, Drupal, and Joomla, as well as application-agnostic remote memory disclosure.
CVE-2026-109618 (continued): Remote Process Memory Disclosure
PHP parses multipart requests during startup before full module initialization. An out-of-memory error can leave a stale session ID pointer that a later request trusts and URL-encodes into a response cookie (PHPSESSID). This leaks live worker memory — including data from other users’ requests — to an unauthenticated attacker. This works even when the application never calls session_start().
CVE-2026-109619: Fatal-Error Backtrace Use-After-Free
PHP retains the backtrace of the most recent fatal error in a global variable. A fatal out-of-memory error can leave that global pointing to freed memory. A subsequent request can access the stale pointer and lead to controlled memory corruption, enabling unauthenticated RCE against Drupal.
CVE-2026-109619 (continued): OPcache Type Confusion
OPcache persists compiled PHP structures in shared memory. An allocation failure during persistence can leave the process-local and shared memory frontiers out of sync. When another worker reuses a freed slot for a different object, shared OPcache metadata resolves to the wrong type, enabling a cross-worker type confusion and an RCE chain against WordPress.
The Role of AI
What makes PHP2Shell historically significant is not just the severity of the bugs — it is that they had existed in the PHP codebase for more than a decade without being practically exploitable. Building a working exploit required chaining multiple memory bugs, accounting for memory layout differences across PHP versions and configurations, and extensive iterative testing. That complexity previously represented a meaningful barrier.
Wiz Research used AI models — specifically Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol — to dramatically reduce that barrier. What would have taken a world-class team months of work was completed by a single researcher in approximately one week. As frontier AI models continue to improve, vulnerabilities previously considered too complex to exploit may become routine attack targets.
Patch and Remediation
The PHP team released a security patch on October 21, 2026. The patch fixes the root cause and eliminates all known variants.
Immediate action required: Update PHP to the latest patched release as soon as possible.
While patching is in progress, defenders should monitor for:
- Unusual multipart HTTP requests followed by memory-limit errors or HTTP 500 responses
- Unexpectedly large or malformed PHPSESSID response cookies
- Unexplained PHP worker restarts or churn
Major cloud and CDN providers — including AWS, Microsoft, Google Cloud, Cloudflare, Akamai, Fastly, Imperva, Automattic, and Vercel — have deployed out-of-band mitigations and customer guidance for organizations that cannot patch immediately.
Key Takeaway for Organizations
If your organization runs any PHP-based application — whether it is a public website, an internal portal, a CMS, or a custom web application — you should treat this as a critical, time-sensitive issue. Contact Southridge Technology if you need assistance assessing your exposure or applying the patch.
