Critical PHP2Shell Security Vulns Evoke ‘Black October’

October 26, 2026 Alex Woodie

AI helped uncover a pair of critical security vulnerabilities in PHP that can be used to execute code, including on IBM i servers, sent administrators around the world scrambling to install patches on a large swath of the Internet’s Web servers before cybercriminals can get to them. The flaws, along with the rapid dissemination of AI-based exploit code, led some organizations to simply unplug their websites, earning the whole episode the name “Black October.”

On October 21, patches for two critical security vulnerabilities in PHP were released. The two vulns, CVE-2026-109619 and CVE-2026-109618, collectively called PHP2Shell, each garnered a …