If you have followed tech news over the last week, you have probably heard about the recent PHP vulnerabilities causing chaos.
Government websites taken offline. Tens of thousands of attacks in under an hour. A patch rushed out in less than a day. This is how a pair of old bugs became one of the biggest security events of the year, and what that tells us about where cybersecurity is heading.
What is PHP?
PHP (short for Hypertext Preprocessor) is an open-source programming language used to build websites and web applications. It works alongside HTML to power a huge share of the sites you visit every day.
According to web technology tracker W3Techs, PHP runs on roughly 70% of all websites whose programming language can be identified.
PHP being so widespread is why these vulnerabilities are so significant.
Two Vulnerabilities
PHP2Shell is the name given to a pair of memory-safety vulnerabilities: CVE-2026-109618 and CVE-2026-109619.
They affect PHP versions 5.4 through 8.5. That is more than a decade of releases, from 2012 to 2025.
Chained together, the two flaws allow a hacker to use remote code execution. In plain terms, an attacker can run their own code on the server hosting a website, giving them access to that site and the data behind it. And it takes only a single web request to do it.
The Bugs Nobody Thought Could be Exploited
The flaws were uncovered by two security firms, Calif and Wiz Research.
Back in 2024, Calif spotted two odd behaviours in PHP's underlying code. At the time, they were judged to be non-exploitable.
That changed in August of this year. Using the AI models Gemini Argon 4 and GPT-5.6 Sol, researchers found that the two vulnerabilities could be chained into a single attack path capable of taking over a web server.
The firms quietly notified the PHP Foundation, the group of people and organizations that maintain the language, and work on a fix began.
Then the Details Leaked
On October 20th, details of the vulnerabilities leaked before the patch was ready.
What followed was a scramble. The fix shipped less than 24 hours later, but that window was more than enough. Any site running unpatched PHP during that time was effectively defenseless.
Among the chaos, organizations like the NSA and CISA weighed in with the same message: apply vendor patches immediately or take unpatched systems offline until you can.
It’s impossible to know just how many attacks succeeded. However, for a sense of scale, Cloudflare reported tens of thousands of automated exploit attempts in just the first 45 minutes after the leak.
What HyCloud is Doing
The good news for our clients is that PHP plays a very small role in the systems we manage. But "very small" is not "zero", and assumptions are not a security strategy. So, our technicians are verifying, not guessing.
That work includes:
A full audit of our applications
Across our own tenant and every client tenant.
A PHP2Shell sweep of every managed Windows server
Checking every PHP install we are responsible for.
Confirming October's cumulative updates
Verifying the Windows October cumulative patch is installed on every server we manage.
What you Can do Personally
This is not a reason to panic. PHP2Shell targets web servers, not your laptop or phone.
But attackers went after thousands of websites, and some of those could be sites you use. That means data you have stored with them, like passwords, may have been exposed.
A few simple habits can go a long way:
Turn on multi-factor authentication
Anywhere it is offered. A stolen password is far less useful to an attacker when it is not enough on its own.
Stop reusing passwords
Open your password manager and look for duplicates. One leaked password should never unlock more than one account.
Revisit old accounts
That shopping site or forum you have not logged into in years still has your details. Change the password or close the account.
Change passwords on the sites you use most
If you are unsure whether a service was affected, updating your password is a small price for peace of mind.
The Bottom Line
It is hard to talk about security right now without talking about AI, and PHP2Shell shows why.
AI found these flaws, combing through code that people had been looking at for over a decade. AI is also what made the leak so dangerous: once the details were out, attackers could build and launch working exploits the same day.
The same tools that help defenders find problems faster help attackers move faster too. The time between a flaw being discovered and a flaw being exploited is shrinking, and the businesses that come through events like this one are the ones that patch quickly and know exactly what they are running.
Not sure whether your systems were exposed to PHP2Shell?
We can help you find out and close the gaps before someone else finds them.
