The PHPGEDDON (CVE-2026-109618 and CVE-2026-109619)

A vulnerability hidden for years

On October 21, 2026, fixes were released for two critical vulnerabilities in the PHP engine: CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2.

The vulnerabilities, also known as PHP2Shell, involve errors in memory handling and internal request state. Under certain conditions, they can allow unauthenticated remote code execution (RCE), regardless of whether the PHP application itself contains a vulnerability.

The discovery is particularly significant: OpenAI, using artificial intelligence models, helped identify flaws that had been present in PHP's codebase for more than a decade, alongside research by Calif and, independently, Wiz.

How widespread is the problem?

I carried out a non-invasive HTTP scan of 1,127,035 Italian and UK domains, looking for PHP versions publicly disclosed by web servers.

The results:

• 101,712 websites exposed an identifiable PHP version.
• 80,185 websites reported a version older than the available fixes or belonging to a legacy release branch.
• That is 7.1% of all domains scanned, or 78.8% of the servers whose PHP version could be identified.

Importantly, these figures do not prove that every identified server is vulnerable. Some may have received security fixes backported by their operating-system vendor without any change to the version number shown in HTTP headers. Others may have temporary mitigations that cannot be detected remotely.

This scan is not a statistically representative sample of the entire European web.

What should you do?

The officially fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Unpatched installations serving web requests may be exposed; older release branches require particular attention and a check for any available vendor backports.

Exploitation depends on server configuration, but unauthenticated attacks have already been demonstrated. WordPress or the application code does not need to contain a vulnerability of its own.

The advice is straightforward: ask your system administrator or hosting provider to confirm that the PHP engine has actually been patched. Updating WordPress or its plugins does not fix this issue.

If you do not have a technical point of contact, now is the time to find one.

Maintenance and recovery

I provide Linux server and VPS administration, PHP updates, migrations, and web infrastructure security services.

If your server needs updates, maintenance, or recovery after a compromise, contact me.

---

Sources: PHP Security Advisory · OpenAI – Patch the Planet · Wiz Research – PHP2Shell

Scan data: October 23, 2026. Percentages refer exclusively to the sample analyzed.