PHP2Shell flaws draw millions of attack attempts as AI speeds exploits

October 22, 2026, saw millions of hackers attempt to take advantage of two major vulnerabilities in PHP. Governments and businesses had to take down some online systems while expert teams hurried to put in place emergency patches. This shows how little time have now been given to cybersecurity specialists to counter serious vulnerabilities. Two 9.2-rated bugs that can hand over a server The vulnerabilities, known together as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both have a critical severity score of 9.2 out of 10. On October 21, 2026, PHP released four fixes for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The UK’s NCSC says the bugs can corrupt PHP’s internal memory. Under certain conditions, an attacker could run code without logging in.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Cryptopolitan.