TL;DR: AI-assisted research helped turn longstanding PHP memory bugs into demonstrated remote attacks. Emergency fixes are available, attack traffic is being reported, and some public services have gone offline as a precaution. The potential exposure is enormous; a reliable count of compromised websites is still missing from the sources reviewed here.

Reporting snapshot: 21 October 2026, 18:45 UTC. This is a developing story.

What PHP2Shell actually does

The two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, concern PHP's handling of memory and fatal errors. Cleanup can use partly initialized data, or a later request can encounter internal state pointing to memory that has already been freed. Both carry a CVSS v4.0 score of 9.2.

Wiz Research demonstrated unauthenticated remote code execution against the WordPress, Drupal and Joomla container images current during its testing. It also demonstrated disclosure of sensitive PHP process memory without first achieving code execution. These are flaws in the runtime beneath the website, so secure application code alone does not prevent exposure.

Original research:
www.wiz.io/blog/php2shell-php-rce

Deployment details matter. PHP says all installations serving web requests are at risk and rates Apache's mod_php highest because a demonstrated attack can start before application code runs. Calif explains why the same startup attack does not transfer directly to PHP-FPM, while showing a different, application-dependent route against PHP-FPM. Switching server type is not an established fix. Successful execution initially has the PHP worker's permissions, rather than automatically granting root access.

Calif's technical account:
calif.io/php2shell/

How much of the Internet is affected?

Wiz's headline says “70% of the Internet.” The underlying usage statistic needs its denominator: W3Techs reports PHP on 69.3% of websites whose server-side programming language it can identify, as of October 21. That is a technology-usage estimate, not a scan proving that those sites are exploitable or have been breached.

The legacy tail is substantial: its PHP breakdown still shows 27.0% on PHP 7 and 7.7% on PHP 5. Those figures do not establish whether individual installations have vendor security backports. They do illustrate why patching will involve much more than modern applications receiving routine updates.

w3techs.com/technologies/details/pl-php

What is happening online already

• Attack traffic: Cloudflare says it observed attacks and attackers modifying payloads to evade protections. Its PHP2Shell WAF protections were enabled by default for customers using its free or paid WAF from 03:02 UTC on October 21. That is evidence of hostile activity, not a published count of successful compromises.
  blog.cloudflare.com/php-vulnerabilities-waf-protection

• Different observation windows: watchTowr says its global honeypot network observed exploitation on October 21. Imperva says it saw no traffic matching its monitored exploit patterns during its pre-disclosure monitoring period. Different sensors, time windows and terminology make these reports unsuitable for combining into a global breach estimate.
  watchtowr.com/intelligence/php-cve-2026-109618-faq/
  www.imperva.com/blog/php2shell-vulnerability-updates/

• Real disruption, even without a confirmed breach: the Dutch government reported precautionary shutdowns including Overheid.nl, MijnOverheid.nl and DigiD. Its notice said it had no indications of active misuse at that point. It also stressed that many government websites, including Rijksoverheid.nl itself, do not use PHP.
  www.rijksoverheid.nl/actueel/nieuws/2026/10/21/aantal-websites-rijksoverheid-preventief-offline-na-kwetsbaarheden-php

• Public services affected: Finland's Food Authority reported temporarily closing services including its food-poisoning registry, a laboratory pathogen-reporting system and its phytosanitary-certificate system. It explicitly said it had identified no exploitation in those services. Its later Swedish-language update reports some services returning. These closures were protective measures, not evidence that those systems had been hacked.
  www.ruokavirasto.fi/en/about-us/services/uutiset/some-of-the-finnish-food-authoritys-services-are-closed/
  www.ruokavirasto.fi/sv/om-oss/tjanster/uutiset/en-del-av-livsmedelsverkets-tjanster-ar-stangda/

The UK NCSC's response reaches beyond websites: it asks organisations to identify PHP bundled inside third-party products and appliances, prioritise internet-facing systems, and consider taking systems offline if timely remediation is impossible. A website can therefore be affected operationally even when its main application is written in another language.

www.ncsc.gov.uk/news/critical-security-issue-affecting-php

What AI contributed — and what the maintainers add

Wiz credits Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol with helping discover the flaws, develop and adapt exploit chains, and validate fixes. Its consequential claim is that AI reduced the specialist effort needed to make difficult memory bugs practically exploitable across different deployments.

The PHP Foundation supplies essential context: a core developer had found the first signs of the out-of-memory problem while addressing a 2024 audit. Work on a fix stalled over compatibility, performance, decision-making and staffing constraints. Calif, OpenAI and Wiz later supplied reports that established the full impact and made remediation the priority. The Foundation also says AI helps validate reports, while people make the decisions and work on every patch.

Disclosure coordination mattered too: PHP moved the release forward from October 22 to October 21 after information began circulating early.

My reading: this shows AI increasing the practical reach of security research, alongside a continuing need to fund the maintainers who turn findings into deployable fixes.

thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

What operators need to check

PHP's fixed upstream releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distributions and LTS vendors may deliver backported fixes, so check the actual vendor advisory rather than judging protection from a version banner alone. PHP 8.1 and older no longer receive normal upstream updates; PHP has nevertheless supplied minimal source backports for 7.4, 8.0 and 8.1 to help older deployments.

Updating WordPress, a plugin or another application alone does not update the underlying PHP runtime. Managed-hosting customers need their provider to confirm the PHP fix. WAF rules and configuration changes can reduce particular attack paths, but PHP's warning is explicit:

“There are no complete mitigations, updating is the only safe choice.”

Official advisory, fixed versions and partial mitigations:
www.php.net/archive/2026.php#2026-10-21-5

Patch status, observed attacks and confirmed compromise are separate questions. This snapshot establishes an urgent patching problem and service disruption; it does not establish that 70% of the Internet has been compromised.