PHP Vulnerabilities Prompt Global Patch Effort

A critical vulnerability has been identified in PHP, prompting a global effort to patch vulnerable websites as quickly as possible. The PHP Project has released patches for two separate vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which have earned critical severity scores of 9.2.

These flaws are particularly concerning because they can be exploited even if the underlying application is secure, putting every affected website at risk. PHP is a widely used programming language that provides the foundation for many websites and services we rely on daily, including e-commerce platforms and WordPress sites.

The vulnerabilities were discovered by Wiz's security team with the assistance of AI, which found that PHP is present on approximately 70% of the world's websites. According to Wiz, these flaws include memory disclosure and unauthenticated remote code execution in PHP itself.

The patches released by the PHP Project are essential for mitigating the risk associated with these vulnerabilities, but it's crucial for website administrators to act promptly and apply the fixes as soon as possible to prevent potential attacks.

The vulnerabilities associated with P2P2Shell pose a significant threat to unpatched systems, allowing attackers to execute code and access sensitive process memory on affected servers.

Researchers have noted that AI has played a dual role in this situation - it not only facilitated the discovery of these vulnerabilities but also enabled the creation of an attack chain. The complexity of developing such a chain would be beyond human capabilities, but frontier AI models made it feasible to turn these flaws into exploitable bugs.

Evidence suggests that malicious actors were already attempting to exploit P2P2Shell before its vulnerabilities became public knowledge. Within four days of the disclosure, attempts to take advantage of the weaknesses began to emerge, with proof-of-concept works appearing shortly after.

Furthermore, a threat actor linked to P2P2Shell attack chains is reportedly seeking to deploy a Mirai-style botnet. Cloudflare's network has seen a massive influx of exploitation attempts, with its CEO, Matthew Prince, stating that millions of such attempts are now being recorded.

The PHP Project has issued an advisory recommending that organizations set session.upload_progress.enabled=0 as a mitigation measure until further scheduled bug fixes become available. This precautionary step can help protect against another Remote Code Execution (RCE) vector associated with P2P2Shell.

The PHP Project has provided guidance on how to mitigate the vulnerability associated with P2P2Shell, even if a patch is not immediately available.

To minimize the risk of exploitation, application developers must ensure that session.serialize_handler is set to php_binary or php_serialize in their configuration and then switch it to php at runtime using ini_set() before calling session_start(). This unusual setup makes the attack vector less likely, but mitigation is still necessary until a patch is released.

The PHP Project recommends enabling session upload progress, which must still be active even if applications never change the serialize handler at runtime. This feature can remain enabled in these cases.

In addition to applying patches as soon as possible, organizations should prioritize vendor-issued updates tied to PHP2Shell and consider implementing mitigative steps such as enhanced logging.

The National Security Agency has advised heightened awareness of this vulnerability over the coming weeks, emphasizing that vigilance is crucial when applying patches related to vulnerable systems.

Patches for vulnerable systems are readily available, according to Matthew Weier O'Phinney, principal product manager of Perforce Zend and OpenLogic.

He advises updating using a system package manager as a quick remedy if you're already running one of the affected distributions, which had patches released either at the time or shortly after the coordinated vulnerability announcement.