The PHP meltdown endangered 70% of world homepages.

The last PHP meltdown was bad. 70% of the homepages were vulnerable. Due. To issues outside the PHP code itself. The meltdown happened in the so-called Zend engine. “Two critical vulnerabilities in PHP, the programming language behind around 70% of websites worldwide, have prompted urgent warnings from cybersecurity agencies. Dubbed PHP2Shell, the flaws could allow attackers to remotely run malicious code, steal sensitive data, and take control of affected servers without authentication.” (Livemint.com, Decade-old PHP bug puts websites at risk: How AI uncovered it, who is vulnerable and how to stay safe | Explained)

“CVE-2026-109618 (Uninitialized Request Memory): When a PHP script exhausts system resources and triggers an out-of-memory (OOM) error, the runtime utilizes a low-level C function known as longjmp() to abort execution. Due. To. Faulty control flow logic. This abrupt exit leaves request memory uninitialized. By feeding specially crafted HTTP requests designed to trigger resource exhaustion, remote attackers can reliably leverage these uninitialized buffers to execute arbitrary commands on the host server.” (Clarin.com, PHP vulnerability 2026 explained: What happened with 'PHP2Shell', how it affects millions of sites, patches and what precautions you must take)

“CVE-2026-109619 (Dangling Global Memory References): In this parallel flaw, a fatal error condition handled via longjmp() causes global memory pointers to reference memory regions that have already been freed. When the persistent PHP process serves subsequent incoming web requests. It reads or branches from these invalidated memory addresses, enabling an attacker to trigger process crashes, siphon sensitive customer data from memory, or achieve full system takeovers.”(Clarin.com, PHP vulnerability 2026 explained: What happened with 'PHP2Shell', how it affects millions of sites, patches and what precautions you must take)

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Key takeaways from Flowninja.com

*PHP2Shell is two critical flaws in PHP itself that let attackers run code on a server without logging in.

*The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026.

*WordPress, Drupal, Joomla and Magento were all shown exploitable; CMS and plugin updates leave the flaw in place.

*PHP 8.1 and older get no official fix, and about a third of PHP sites still run PHP 7 or older.

*US, UK and EU agencies said to take systems offline or isolate them if you could not patch.

*By October 22, Sansec judged mass exploitation less likely because the public exploits need specific server conditions.

*Webflow says its core services are not built on PHP and its customers needed no action.

https://www.flowninja.com/blog/php2shell

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

“PHP is the programming language running on the server behind WordPress, Drupal, Joomla, Magento. And countless custom sites. W3Techs finds it on 69.3% of websites whose server-side language it can detect (October 22, 2026).” (Flowninja, PHP2Shell explained: what happened, which platforms were hit, and what to do now)

“PHP2Shell lets one crafted web request corrupt PHP's memory and run the attacker's code with the permissions of the server's PHP process. PHP's advisory says the attack can trigger "before any application code runs", so the CMS on top makes no difference.”  (Flowninja, PHP2Shell explained: what happened, which platforms were hit, and what to do now)

“The second PHP vulnerability can also disclose worker memory, and code running on your server can reach its files, database, and stored credentials. Affected releases date back to PHP 5.4.” (Flowninja, PHP2Shell explained: what happened, which platforms were hit, and what to do now)

That vulnerability. It allowed hackers to crack the system. Through. The Zend Engine.  This kind of vulnerability is one example. How. Important. It is important to keep the system updated. That means that. Also. Virtual. Engines must be updated. And the second thing is that. If. Hackers get. The Zend Engine source code in hand. They can find vulnerabilities. Another problem is that. Use. AI in that operation is possible. That means that. This kind of vulnerability means that the core component is open. The ability to run hostile code in the system opens it to worms. The hacker can slip malware through that hole. 

So, what does this mean? Even the best coders cannot protect the system. If. There is a vulnerability in the core. Another. Thing that makes these kinds of vulnerabilities critical is that Hackers can slip so-called sleeping malware into the system. The malware can be silent. Until. It is activated. The activator can be a certain date. Or it can be code. That comes from outside. If. 70% of homepages are vulnerable. That causes a very large-scale threat. But the threat can be in things that we don’t see. 

https://www.clarin.com/us-news/php-vulnerability-2026-explained-what-happened-with-php2shell-how-it-affects-millions-of-sites-and-what-precautions-you-must-take_0_mIsl8QvvI4.html

https://www.flowninja.com/blog/php2shell

https://www.livemint.com/ai/decadeold-php-bug-puts-websites-at-risk-how-ai-uncovered-it-who-is-vulnerable-and-how-to-stay-safe-explained-11792639095140.html