PHP Releases Urgent Patch for Critical Vulnerability
The security flaw, discovered via AI, affects millions of servers and requires an immediate update to stay protected.
Updated on Oct. 23, 2026 in Cybersecurity
Live Poll
Do you trust that major software companies are doing enough to secure the internet's older code?
Security researchers have identified two critical vulnerabilities in the PHP programming language that allow unauthorized server access when a process crashes. A patch was released on October 22, 2026, as millions of exploit attempts were observed across global web infrastructure.
Why it matters
These flaws highlight the security risks inherent in legacy codebases that have remained largely unexamined since the 1990s. The discovery demonstrates how AI models are now significantly lowering the barrier for identifying deep-seated vulnerabilities in widely used software.
The vulnerabilities reside in the PHP code handling crash events, where memory data becomes accessible to subsequent requests after a process failure. Affected users must update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to remediate the flaw.
The players
PHP
A widely used general-purpose scripting language that powers approximately 70 percent of websites.
Wiz
A cloud security firm that utilized AI models to identify the underlying vulnerabilities.
CERT-In
The Indian national nodal agency responsible for responding to computer security incidents.
Amazon
A global cloud computing and e-commerce provider that first detected exploitation attempts.
Calif
A security research entity that initially identified the first PHP2Shell vulnerability.
The details
Known as PHP2Shell, the vulnerabilities allow unauthorized access by leaking memory data when a PHP process terminates unexpectedly. This flaw originates from code written in the early 1990s that had not undergone comprehensive auditing until researchers employed AI models to analyze the structure. By identifying these crash-event handlers, the researchers found that subsequent server requests could extract sensitive memory contents left behind by the crashed process.
Timeline
August 2026: Calif identifies the first PHP vulnerability.
October 17, 2026: Amazon detects the first exploitation attempts.
October 22, 2026: PHP releases a security patch.
October 23, 2026: Public disclosure occurs and CERT-In issues an advisory.
The Tech Race
The discovery of PHP2Shell represents a shift in security research where AI is now faster at finding legacy bugs than manual audits. This development follows the precedent of the 2014 Heartbleed vulnerability by exposing a fundamental, long-neglected flaw in a ubiquitous software foundation.
Administrators managing the estimated 750,000 servers on unsupported PHP versions must prioritize immediate updates to secure their environments. Websites using supported versions must apply the specific patch releases for 8.2, 8.3, 8.4, or 8.5 to prevent unauthorized server access.
The takeaway
The rapid surge in attack attempts observed by Cloudflare underscores the necessity of immediate patching for all server infrastructure. Organizations should monitor their PHP runtime versions and cross-reference them against the latest releases to ensure the PHP2Shell vulnerability is mitigated.
Further reading
For more on evolving threats to web infrastructure, visit our Cybersecurity section.
Source note: This article includes information reported by Economic Times.
Live Poll
Do you trust that major software companies are doing enough to secure the internet's older code?
