Critical PHP2Shell Security Vulns Evoke ‘Black October’
October 26, 2026 Alex Woodie
AI helped uncover a pair of critical security vulnerabilities in PHP that can be used to execute code, including on IBM i servers, sent administrators around the world scrambling to install patches on a large swath of the Internet’s Web servers before cybercriminals can get to them. The flaws, along with the rapid dissemination of AI-based exploit code, led some organizations to simply unplug their websites, earning the whole episode the name “Black October.”
On October 21, patches for two critical security vulnerabilities in PHP were released. The two vulns, CVE-2026-109619 and CVE-2026-109618, collectively called PHP2Shell, each garnered a 9.2 on the Common Vulnerability Scoring System (CVSS) rating system, as they can be exploited to allow unauthenticated attackers to run arbitrary code and steal data from impacted systems by sending a specially crafted HTTP request. It’s not the perfect 10.0 achieved by the notorious Log4j back in 2021, but it’s not far off.
The flaws impact every version of PHP from 5.4 to 8.5 running on every platform, including IBM i. The two leading PHP providers in the IBM i world, Seiden Group and the Zend unit of Perforce, both released updates of their IBM i distributions based on new releases of PHP (versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) issued by the PHP Foundation to correct the two flaws.
Seiden Group updated the current supported PHP versions, 8.2, 8.3, 8.4, and 8.5 for its Seiden PHP+ Server offering, and also updated some older versions, including PHP 7.4, 8.0, and 8.1, which are considered end-of-life by the PHP community and no longer receive security patches. “We have back-ported updates for these EOL releases, even though those versions no longer receive official security fixes,” CEO Alan Seiden wrote in an October 21 blog post.
Seiden added that it could also backport PHP 7.3 if needed, but customers running 7.2 and older will need to upgrade (Seiden never supported those older releases.)
Zend, which was the original PHP company and has been developing and supporting PHP on IBM i for decades, also issued new releases with the patches for its supported PHP distributions, which run on IBM i and other operating systems.
Credit: Wiz
“We released PHP2Shell patches for key end-of-life (EOL) PHP versions – including PHP 7.2, 7.3, 7.4, 8.0, and 8.1 – so your team can get covered while you plan your next move,” wrote Matthew Weier O’Phinney, the principal product manager at Perforce Zend, in an October 22 blog post.
The fact that the PHP2Shell vulnerabilities impacted 70 percent of the world’s websites was bad enough, but the situation was made worse by the timing of the news.
The PHP Foundation and the wider PHP community had been working on fixes for the popular scripting language for weeks after the flaws were discovered by security researchers with the help of AI in August. But word somehow got out days ahead of the October 21 embargo, leading to some hasty work by the PHP community to accelerate testing and get the patches out to the world before hackers could exploit the vulnerabilities first.
“PHP security team was already in the process of a coordinated release, spanning around 100 distribution channels, and were 2 days from release when a leak forced them to move forward with patches, which were released on 10/21/2026,” O’Phinney writes on the Zend blog.
Despite the bad optics over the timing of the release and the potential for serious harm, the PHP community did everything by the book, Seiden told IT Jungle.
“No one hacked yet that we know of, because the PHP community planned this quite well upon discovering the issue, working on it privately and releasing the know-how to select maintainers (such as us/Calvin [Buckley]) with an embargo on disclosure until we had an opportunity build the updates and get them installed for customers,” Seiden said via email. “Unfortunately, a couple of companies leaked the information, forcing the PHP community to accelerate the release.”
Amazon, which is a big user of PHP and an active member of the PHP community, reports that someone tried to use PHP2Shell exploit code on the Internet as early as October 17.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” wrote CISO of Amazon Integrated Security CJ Moses in an October 21 blog post.
Within hours of PHP2Shell’s formal release by the PHP Foundation, Amazon’s honeypots detected increased exploit proof-of-concept activity. “PHP2Shell is now seeing broad exploitation attempts in the wild,” Moses wrote.
The folks at Calif turned the discovery of PHP2Shell into a graphic novel. Click image for link.
The potential threat from PHP2Shell was serious enough that it led the leaders of some national governments to take their websites down. The Dutch, French, Danish, and Finnish governments all took sites offline as a precaution, Reuters reported.
Even though patches are now available, the threat is not over. Shahak Shalev, the global head of scam and AI research at Malwarebytes, urged website owners to be vigilant.
“This is a goldmine for hackers,” Shalev said in a blog post. “They can hijack real websites to take advantage of the site’s reputation to do things like phish people, serve malicious software from the trusted channel. The opportunities are endless.”
PHP2Shell is being actively exploited by a range of cyber crooks, from supplicated hackers to unsophisticated script kiddies. The advent of powerful generative AI tools has significantly lowered the barrier to entry for cybercriminals, as AI-generated exploit code is now rampant across the Internet.
Ironically, we also have AI to thank for finding the PHP2Shell flaws, which have existed for over a decade, buried in the PHP code. Ryan Austin, a security researcher at Calif, is credited with uncovering the flaws first with help from OpenAI’s GPT-5.6 Sol and Stefan Esser, his colleague at Calif.
“We were not expecting to find anything critical – everyone and every lab had already done extensive AI assisted audits of this target,” Austin wrote in a Calif blog post. “But, only a few days after starting the audit and asking the right questions related to Stefan’s earlier findings, we managed to surface the first OOM-fatal (more about that soon) and the first of the three interruption points that allowed us to piece together an RCE against WordPress.
The PHP2Shell flaws were also discovered by Wiz, a Google-owned security research group, a couple of weeks after Calif. The researchers at Wiz reportedly used their AI-powered security research tool, dubbed Wiz Atlas, as well as Google’s Gemini 4 Argon and GPT-5.6 Sol, the souped-up hacker LLM that OpenAI apparently let out of its cage earlier this year, whereupon it promptly attacked Hugging Face.
Just as the Heartbleed OpenSSL vulnerability discovered in 2014 and 2021’s Log4J episode changed the nature of cybersecurity work, these new PHP vulnerabilities will become known for how AI is impacting security, according to Wiz researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld, and Tomer Schwartz.
“We believe PHP2Shell could mark a similar turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding vulnerabilities,” the Wiz researchers wrote in a blog post.
“Building the exploit required chaining multiple flaws and adapting to each target’s memory layout through repeated testing and debugging,” they wrote. “Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours. As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice.”
RELATED STORIES
PHP’s Evolution On The IBM i Platform Continues
It’s D-Day For Cybersecurity, AI Firms Warn
What Is Threatening IBM i Security Now
Critical Log4j Vulnerability Hits Everything, Including the IBM i Server
