PHP2Shell and GitLab Flaws Set Off 72-Hour Global Security Crisis

The two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10, affect versions from PHP 5.4 onward, a span of 12 years, according to the report. An attacker needs no credentials and can take over a server with a crafted HTTP request. PHP runs on more than 70% of websites. Censys data cited in the report showed that about 1.5 million of 2.6 million PHP hosts were unpatched at the time.

Amazon's security team detected anonymous exploitation attempts against the PHP flaw in honeypot systems on Oct. 17, four days before disclosure, the report said. After the patch release, the Dutch national cyber security center took its website offline, followed by Dutch government portals, the Port of Rotterdam, the national football association, five political parties and several hospitals. Denmark shut a national school communications platform, Finland's state IT provider cut public government network services, France's interior ministry moved websites into preventive maintenance, Wikipedia closed some systems and the Internet Archive briefly went offline.

PHP issued patches for its 8.2 to 8.5 branches. PHP 8.1 and earlier versions are no longer maintained and will not receive official fixes. The U.S. National Security Agency and FBI issued warnings urging organizations to update immediately or take vulnerable systems offline.

The report traced the PHP flaws to incomplete cleanup after memory exhaustion, which left stale pointers and allowed a later request to execute data as code. The underlying risk had been known in parts since 2004, when PHP security researcher Stefan Esser found related memory-cleanup problems, and it surfaced in later bug reports and a 2024 code audit. Calif Research researcher Ryan Austin, working under OpenAI's Patch the Planet program, used a large language model to turn a code pattern from one flaw into search rules and found two more exploitable points within hours, the report said. Wiz and OpenAI teams independently found the same group of flaws with AI tools.

GitLab also disclosed a maximum-severity, unauthenticated remote code execution flaw affecting all versions released over the past 12 years, according to the report. Node.js released fixes for more than 10 vulnerabilities, four of them high severity. Nginx had patched five flaws a week earlier, including buffer overflow and use-after-free issues that could allow an attacker to seize control of a system.

The report also cited a weak-entropy flaw in certificate authority eMudhra. Major browsers had blocked it, but curl, Python and Go still trusted the certificate chain by default, leaving a path for man-in-the-middle attacks that could impersonate websites.

Separately, attackers claimed to have stolen 10.6TB of core data from PingCAP's TiDB Cloud, including customer API keys and code repository information, according to the report. Plex media servers were found with a vulnerability chain used for cryptocurrency mining and backdoors. India's State Bank of India confirmed a data breach.

Wiz described PHP2Shell as a watershed comparable to Heartbleed in 2014 and Log4Shell in 2021, the report said. The PHP2Shell discoverer said AI-assisted code analysis helped find a flaw that had been hidden for years, while researchers used AI to find four GitLab regex-engine flaws in a month.

Editor's Summary

The PHP2Shell disclosure and related GitLab, Node.js, nginx and certificate issues forced emergency patching across global internet infrastructure. The episode also showed how AI-assisted code analysis is accelerating vulnerability discovery as attackers and defenders race after patches are released.