Two critical bugs, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution; agencies urge immediate updates while numerous websites experience outages

With governments and corporations spending the weekend patching two critical flaws in PHP, some cybersecurity professionals have begun calling the episode “Black October”, according to CNBC News.

The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, and known together as “PHP2Shell”, can let attackers run code on a server without logging in. The PHP Foundation had released fixes on 21 October 2026 for versions 8.2 through 8.5, and in the US, the FBI had issued a public service announcement on 23 Oct 2026, announcing security updates were available and should be applied immediately, according to News Week.

The NSA, FBI, and CISA had urged organizations to patch immediately and to take systems offline if they could not. “These vulnerabilities often provide a direct path to the server’s file system or database,” the NSA had announced.

Elsewhere, government websites in Britain, Finland, and Japan had experienced outages or reduced service during the response.

Fortuitous discovery

The discovery of the vulnerabilities had come about via an AI agent. In August this year, researcher Sagi Tzadik had prompted an AI agent to adapt a WordPress exploit for Drupal. The agent failed but instead uncovered a PHP flaw that had gone unnoticed for more than a decade.

Separately, Calif, working with OpenAI, had found a related bug. A group of about 15 people then collaborated on a fix, according to TIME. Word of the flaws spread two days before the planned patch date, leading PHP’s maintainers to release the fix a day early.

Hours later, Calif mistakenly posted a video of its exploit. Tens of thousands of exploitation attempts subsequently took place within 45 minutes of the public announcement, eventually escalating to millions.

The PHP Foundation said the issue had been known since at least 2024, and called the delay “a structural failure”, according to a WIRED report. Experts say website operators bear most of the responsibility, but individuals can still protect themselves.

Dan Guido of Trail of Bits has recommended enabling automatic updates for phones, computers, and home routers. Others advised multi-factor authentication and unique passwords for each site. “You can’t patch your hospital’s website,” Guido said.

Former CISA Director Chris Krebs has urged the smaller firms to scan for vulnerabilities constantly and apply patches quickly. “This is a significant week or two in cybersecurity,” he had told CNBC.