{"slug": "google-aws-microsoft-address-php2shell-vulnerability-that-is-affecting-70-of", "title": "Google, AWS & Microsoft Address PHP2Shell Vulnerability That Is Affecting 70% Of Internet", "summary": "Wiz Research disclosed two critical PHP core vulnerabilities on October 21, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2, allowing unauthenticated remote code execution and, in one case, leakage of passwords and API keys from server memory. Every PHP version back to 5.4 is affected, with fixes released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Google Cloud, AWS and Microsoft have published customer guidance, and AWS said its MadPot honeypot network logged an exploit attempt on October 17, four days before public disclosure. Because PHP runs roughly 70% of websites on the internet, AWS warned PHP2Shell is now being broadly exploited in the wild and that no configuration-only workaround fully covers both flaws.", "body_md": "From Google to Amazon Web Services, Microsoft, and others, BigTech firms have published guidance for customers ever since critical flaws in core [PHP](https://in.mashable.com/se/?q=php), collectively named [PHP2Shell](https://in.mashable.com/tech/115233/what-is-php2shell-the-security-threat-that-has-exposed-the-entire-internet-to-hackers), were disclosed on October 21. Dubbed the ‘backbone of the internet,' PHP, a general-purpose scripting language, was found riddled with bugs by a [cybersecurity](https://in.mashable.com/se/?q=cybersecurity) firm, Wiz Research, that collaborated with Caif and OpenAI in the discovery.\n\nThe flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2. They let an attacker run code on a server without logging in, and one of them can also leak passwords and API keys from server memory. Every PHP version going back to 5.4 is affected, and fixes arrived in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Since PHP runs around 70% of the websites hosted on the internet, it's imperative to get it fixed.\n\n[php2shell - A tale of two PHP remote vulnerabilities:](https://x.com/calif_io/status/2112905223929049457)[https://t.co/KEUVez9Zdl](https://t.co/KEUVez9Zdl) [pic.twitter.com/WG1LB5pQIQ](https://t.co/WG1LB5pQIQ)\n\n[October 21, 2026](https://x.com/calif_io/status/2112905223929049457?ref_src=twsrc%5Etfw)\n\n[🚨 BREAKING:](https://x.com/wiz_io/status/2112899813264277528) [@Wiz_io](https://x.com/wiz_io?ref_src=twsrc%5Etfw) Research uncovers [#PHP2SHELL](https://x.com/hashtag/PHP2SHELL?src=hash&ref_src=twsrc%5Etfw), a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. [pic.twitter.com/B7yEQuhnoS](https://t.co/B7yEQuhnoS)\n\n[October 21, 2026](https://x.com/wiz_io/status/2112899813264277528?ref_src=twsrc%5Etfw)\n\n[— Wiz (@wiz_io)](https://x.com/wiz_io/status/2112899818062594266) [October 21, 2026](https://x.com/wiz_io/status/2112899818062594266?ref_src=twsrc%5Etfw)\n\n## Google Claims Cloud Not Vulnerable\n\nIn its latest tech blog, Google Cloud stated that its infrastructure is not affected, but customers running PHP on it may be. The firm remarked that App Engine standard apps on PHP 8.2 or newer are patched automatically. However, App Engine flexible apps need a manual redeploy, and Cloud Run services without automatic base image updates have to be rebuilt. You can read more on Google’s bl;og [here](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619).\n\n## AWS Claims Attack Was Discovered Earlier\n\nPer its latest [update](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/?tag=zdintlmashablein-21), Amazon’s MadPot honeypot network logged an exploit attempt on October 17, four days before the public advisory. The attack was from an IP address tied to a commercial anonymization network. AWS says PHP2Shell is now being broadly exploited in the wild and that no configuration-only workaround fully covers both flaws. Its internal systems are automatically restricting malicious scanning aimed at the bugs.\n\nPer the latest report, PHP is not releasing fixes for versions 8.1 or earlier, which have reached the end of life, so Google says apps on those versions must be upgraded to PHP 8.2 or newer.\n\n[— Wiz (@wiz_io)](https://x.com/wiz_io/status/2112899823238021141) [October 21, 2026](https://x.com/wiz_io/status/2112899823238021141?ref_src=twsrc%5Etfw)\n\nAccess the Wiz report on the PHP2Shell vulnerability [here](https://www.wiz.io/blog/php2shell-php-rce).\n\n**See Also**: [eMudhra Cybersecurity Fiasco: CERT-In Warns of Fake Website Certificates, Shares Safety Tips](https://in.mashable.com/tech/115214/emudhra-cybersecurity-fiasco-cert-in-warns-of-fake-website-certificates-shares-safety-tips)\n\nCover: Wiz", "url": "https://wpnews.pro/news/google-aws-microsoft-address-php2shell-vulnerability-that-is-affecting-70-of", "canonical_source": "https://in.mashable.com/tech/115240/google-aws-microsoft-address-php2shell-vulnerability-that-is-affecting-70-of-internet", "published_at": "2026-10-22 09:36:51+00:00", "updated_at": "2026-10-22 10:14:29.205858+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety"], "entities": ["Wiz Research", "Google Cloud", "Amazon Web Services", "Microsoft", "PHP", "CVE-2026-109618", "CVE-2026-109619", "OpenAI"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/google-aws-microsoft-address-php2shell-vulnerability-that-is-affecting-70-of", "markdown": "https://wpnews.pro/news/google-aws-microsoft-address-php2shell-vulnerability-that-is-affecting-70-of.md", "text": "https://wpnews.pro/news/google-aws-microsoft-address-php2shell-vulnerability-that-is-affecting-70-of.txt", "jsonld": "https://wpnews.pro/news/google-aws-microsoft-address-php2shell-vulnerability-that-is-affecting-70-of.jsonld"}}