Overview

PHP2Shell or the 2026 PHP Vulnerability, also known as the 2026 PHP Hack, refers to two critical and widespread vulnerabilities, referred to as CVE-2026-109618 and CVE-2026-109619, found in PHP code (used by an estimated 70 percent of websites on the internet) that could allow a hacker to access a website's file system and database and force code on a site via remote code execution, or RCE.

The vulnerabilities were purportedly discovered by the cloud security company Wiz using AI and were made publicly known in late October 2026 by the National Security Agency's (NSA) cybersecurity division. The vulnerabilities caused numerous websites, including government sites, to temporarily shut down as they waited for an update to patch the exploits. The patch was released on October 21st, 2026.

During the course of the announcement of the PHP vulnerabilities in late October 2026, the event inspired widespread media coverage, online discourse and memes, including posts about the claim that AI was used to discover the vulnerabilities, as well as AI potentially being used to exploit them.

Background

On October 21st, 2026, hackers began using two PHP vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619, to take over websites using PHP code. The vulnerabilities allowed hackers to access file systems and databases on a website and essentially take it over or steal personal information. Reportedly, the vulnerabilities were found using AI by the cyber company Wiz.^[1][2]

That day, numerous government websites went down to wait for a patch for the PHP vulnerabilities.^[3] That morning, the @NSACyber X^[4] / Twitter page posted an announcement about the vulnerabilities, garnering over 67,000 likes and 12,000 reposts in a day.

Developments

On October 21st, 2026, the developers of the PHP programming language released critical updates to fix the vulnerabilities found in the code.^[5]

Wired reported that hackers used the vulnerabilities days before they were patched.^[6] Some of the sites that went down to await the PHP update included 4chan, Wikipedia, Fur Affinity, the video game Umamusume and many more.^[7]

Online Reactions

The PHP vulnerabilities became the subject of significant online discourse and memes as awareness of the issue started to spread online in late October 2026.

On October 21st, 2026, YouTuber^[8] SomeOrdinaryGamers posted a video explaining the vulnerabilities, garnering over 433,000 views in a day.

That day, X^[9] user @digitalshane_ posted a meme about asking Claude AI to patch the vulnerabilities, gaining over 1,000 likes in a day.

Also on October 21st, the Instagram^[10] account @thepintnewsletter shared a post discussing the incident that day, sharing a series of memes about software engineers having to work overtime to fix the security bug, garnering over 12,400 likes and 80 comments in a day.

Later that day, X^[12] user @nanomachiner used the Future Sending Exes Texts meme format to make a joke about the PHP vulnerability, garnering over 497,000 views, 33,000 likes and 90 replies in a day.

On October 22nd, 2026, Redditor foxdevuz posted a Reginald Skulinski Stare meme to the /r/ProgrammerHumor^[11] subreddit, criticizing other devs about the RCE problems within Rust, Java and JS, receiving over 3,300 upvotes and 280 comments in 11 hours.

Search Interest

External References