# Google, AWS & Microsoft Address PHP2Shell Vulnerability That Is Affecting 70% Of Internet > Source: > Published: 2026-10-22 09:36:51+00:00 From Google to Amazon Web Services, Microsoft, and others, BigTech firms have published guidance for customers ever since critical flaws in core [PHP](https://in.mashable.com/se/?q=php), collectively named [PHP2Shell](https://in.mashable.com/tech/115233/what-is-php2shell-the-security-threat-that-has-exposed-the-entire-internet-to-hackers), were disclosed on October 21. Dubbed the ‘backbone of the internet,' PHP, a general-purpose scripting language, was found riddled with bugs by a [cybersecurity](https://in.mashable.com/se/?q=cybersecurity) firm, Wiz Research, that collaborated with Caif and OpenAI in the discovery. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2. They let an attacker run code on a server without logging in, and one of them can also leak passwords and API keys from server memory. Every PHP version going back to 5.4 is affected, and fixes arrived in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Since PHP runs around 70% of the websites hosted on the internet, it's imperative to get it fixed. [php2shell - A tale of two PHP remote vulnerabilities:](https://x.com/calif_io/status/2112905223929049457)[https://t.co/KEUVez9Zdl](https://t.co/KEUVez9Zdl) [pic.twitter.com/WG1LB5pQIQ](https://t.co/WG1LB5pQIQ) [October 21, 2026](https://x.com/calif_io/status/2112905223929049457?ref_src=twsrc%5Etfw) [🚨 BREAKING:](https://x.com/wiz_io/status/2112899813264277528) [@Wiz_io](https://x.com/wiz_io?ref_src=twsrc%5Etfw) Research uncovers [#PHP2SHELL](https://x.com/hashtag/PHP2SHELL?src=hash&ref_src=twsrc%5Etfw), a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. [pic.twitter.com/B7yEQuhnoS](https://t.co/B7yEQuhnoS) [October 21, 2026](https://x.com/wiz_io/status/2112899813264277528?ref_src=twsrc%5Etfw) [— Wiz (@wiz_io)](https://x.com/wiz_io/status/2112899818062594266) [October 21, 2026](https://x.com/wiz_io/status/2112899818062594266?ref_src=twsrc%5Etfw) ## Google Claims Cloud Not Vulnerable In its latest tech blog, Google Cloud stated that its infrastructure is not affected, but customers running PHP on it may be. The firm remarked that App Engine standard apps on PHP 8.2 or newer are patched automatically. However, App Engine flexible apps need a manual redeploy, and Cloud Run services without automatic base image updates have to be rebuilt. You can read more on Google’s bl;og [here](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619). ## AWS Claims Attack Was Discovered Earlier Per its latest [update](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/?tag=zdintlmashablein-21), Amazon’s MadPot honeypot network logged an exploit attempt on October 17, four days before the public advisory. The attack was from an IP address tied to a commercial anonymization network. AWS says PHP2Shell is now being broadly exploited in the wild and that no configuration-only workaround fully covers both flaws. Its internal systems are automatically restricting malicious scanning aimed at the bugs. Per the latest report, PHP is not releasing fixes for versions 8.1 or earlier, which have reached the end of life, so Google says apps on those versions must be upgraded to PHP 8.2 or newer. [— Wiz (@wiz_io)](https://x.com/wiz_io/status/2112899823238021141) [October 21, 2026](https://x.com/wiz_io/status/2112899823238021141?ref_src=twsrc%5Etfw) Access the Wiz report on the PHP2Shell vulnerability [here](https://www.wiz.io/blog/php2shell-php-rce). **See Also**: [eMudhra Cybersecurity Fiasco: CERT-In Warns of Fake Website Certificates, Shares Safety Tips](https://in.mashable.com/tech/115214/emudhra-cybersecurity-fiasco-cert-in-warns-of-fake-website-certificates-shares-safety-tips) Cover: Wiz