Google, AWS & Microsoft Address PHP2Shell Vulnerability That Is Affecting 70% Of Internet

Wiz Research disclosed two critical PHP core vulnerabilities on October 21, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2, allowing unauthenticated remote code execution and, in one case, leakage of passwords and API keys from server memory. Every PHP version back to 5.4 is affected, with fixes released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Google Cloud, AWS and Microsoft have published customer guidance, and AWS said its MadPot honeypot network logged an exploit attempt on October 17, four days before public disclosure. Because PHP runs roughly 70% of websites on the internet, AWS warned PHP2Shell is now being broadly exploited in the wild and that no configuration-only workaround fully covers both flaws.

From Google to Amazon Web Services, Microsoft, and others, BigTech firms have published guidance for customers ever since critical flaws in core PHP https://in.mashable.com/se/?q=php , collectively named PHP2Shell https://in.mashable.com/tech/115233/what-is-php2shell-the-security-threat-that-has-exposed-the-entire-internet-to-hackers , were disclosed on October 21. Dubbed the ‘backbone of the internet,' PHP, a general-purpose scripting language, was found riddled with bugs by a cybersecurity https://in.mashable.com/se/?q=cybersecurity firm, Wiz Research, that collaborated with Caif and OpenAI in the discovery. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2. They let an attacker run code on a server without logging in, and one of them can also leak passwords and API keys from server memory. Every PHP version going back to 5.4 is affected, and fixes arrived in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Since PHP runs around 70% of the websites hosted on the internet, it's imperative to get it fixed. php2shell - A tale of two PHP remote vulnerabilities: https://x.com/calif io/status/2112905223929049457 https://t.co/KEUVez9Zdl https://t.co/KEUVez9Zdl pic.twitter.com/WG1LB5pQIQ https://t.co/WG1LB5pQIQ October 21, 2026 https://x.com/calif io/status/2112905223929049457?ref src=twsrc%5Etfw 🚨 BREAKING: https://x.com/wiz io/status/2112899813264277528 @Wiz io https://x.com/wiz io?ref src=twsrc%5Etfw Research uncovers PHP2SHELL https://x.com/hashtag/PHP2SHELL?src=hash&ref src=twsrc%5Etfw , a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. pic.twitter.com/B7yEQuhnoS https://t.co/B7yEQuhnoS October 21, 2026 https://x.com/wiz io/status/2112899813264277528?ref src=twsrc%5Etfw — Wiz @wiz io https://x.com/wiz io/status/2112899818062594266 October 21, 2026 https://x.com/wiz io/status/2112899818062594266?ref src=twsrc%5Etfw Google Claims Cloud Not Vulnerable In its latest tech blog, Google Cloud stated that its infrastructure is not affected, but customers running PHP on it may be. The firm remarked that App Engine standard apps on PHP 8.2 or newer are patched automatically. However, App Engine flexible apps need a manual redeploy, and Cloud Run services without automatic base image updates have to be rebuilt. You can read more on Google’s bl;og here https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 . AWS Claims Attack Was Discovered Earlier Per its latest update https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/?tag=zdintlmashablein-21 , Amazon’s MadPot honeypot network logged an exploit attempt on October 17, four days before the public advisory. The attack was from an IP address tied to a commercial anonymization network. AWS says PHP2Shell is now being broadly exploited in the wild and that no configuration-only workaround fully covers both flaws. Its internal systems are automatically restricting malicious scanning aimed at the bugs. Per the latest report, PHP is not releasing fixes for versions 8.1 or earlier, which have reached the end of life, so Google says apps on those versions must be upgraded to PHP 8.2 or newer. — Wiz @wiz io https://x.com/wiz io/status/2112899823238021141 October 21, 2026 https://x.com/wiz io/status/2112899823238021141?ref src=twsrc%5Etfw Access the Wiz report on the PHP2Shell vulnerability here https://www.wiz.io/blog/php2shell-php-rce . See Also : eMudhra Cybersecurity Fiasco: CERT-In Warns of Fake Website Certificates, Shares Safety Tips https://in.mashable.com/tech/115214/emudhra-cybersecurity-fiasco-cert-in-warns-of-fake-website-certificates-shares-safety-tips Cover: Wiz