Savannah, Ga. / Oct. 15, 2026
This month the U.S. Patent and Trademark Office awarded me a patent on DocuHide, a document protection system I first sketched in December 1999. The same week, two critical PHP vulnerabilities, now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), leaked a day before the fix, and attackers were on them almost immediately. Security teams are calling it a global PHP cybersecurity crisis, because PHP sits underneath WordPress and a long list of other platforms. The lesson in both stories is the same one, and it took the industry about 26 years to catch up to it.
The wolf was real this time
If you’ve read my two pieces on Google crying wolf, you know the drill. When Google Cries Wolf and Wolf. Wolf. Wolf. Wolf. walk through the false alarms. Search Console sends an email that reads like a fire alarm, the client panics, and it turns out a robots.txt file was doing its job. Most of the time the alarm is noise.
This week the alarm was real, and Google didn’t sound it. Details of two critical PHP flaws leaked on social media ahead of the planned disclosure. Part of being any good at this work is knowing which kind of alarm you’re hearing. This was the kind where you put the coffee down.
What PHP2Shell is and why it became a global crisis
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and the industry is calling the pair PHP2Shell. Both score 9.2 on the CVSS v4.0 scale. Both can let an unauthenticated attacker run code on the web server, which is what security people call remote code execution. No login, no password, no phishing email. They reach back through every PHP release from 5.4 to 8.5.11, well over a decade of versions.
The two bugs are different animals. CVE-2026-109618 is remote code execution through out-of-memory corruption; PHP gets interrupted while internal request data is only half built, and cleanup then treats the junk as valid. CVE-2026-109619 is remote code execution through stale global state; PHP holds onto request data after the memory behind it has been freed, and a later request handled by the same worker can pick it up.
Why global? PHP runs WordPress, and it runs a long list of other content management systems, stores and custom applications. The advisories say every PHP installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. That is most of the hosting industry.
- Oct 17
Amazon Threat Intelligence logs an exploitation attempt in its telemetry, four days before public disclosure.
- Oct 20 Details leak online ahead of the planned release.
- Oct 21
PHP ships fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Researchers confirm exploitation in the wild.
- Oct 23
PHP publishes an advisory on a related flaw, CVE-2026-115560, in the session upload progress feature. It affects fully patched releases and waits on the next regular update.
Read that timeline twice. The attackers had a head start of days, and the fix didn’t even close the book. There’s another detail I can’t stop thinking about. One of the exploits works against mod_php, and it fires on an unauthenticated request before any application code runs. Your security plugin, your login lockout, your carefully hardened theme; none of it gets a vote.
Patch today. But a perimeter that only holds if you’re faster than the attacker is a perimeter that runs on luck.
December 1999
In December 1999 I started working on what became DocuHide. The working name was secure user, secure reader, secure writer, which tells you how much marketing I put into it. The idea was simple. A document shouldn’t depend on the building it’s stored in. Walls get breached. Servers get popped. Somebody always leaves a door open, and it’s usually a Friday.
I had a second worry too, and that’s the one the industry took longer to take seriously. The math that protects documents isn’t permanent either. Peter Shor published his quantum factoring algorithm in 1994, five years before I started sketching, and it said plainly what a big enough quantum computer would do to the public-key cryptography the whole internet leans on. The name post-quantum cryptography hadn’t caught on yet, but the premise was already on the table. Assume the wall falls. Then assume the lock falls too, eventually.
Assume the wall falls. Then build something that still holds.
Why the math matters now
It’s not a thought experiment anymore. NIST finalized its first post-quantum standards in August 2024, including the lattice-based ML-KEM for key exchange and ML-DSA for digital signatures, which you may know by their earlier names, Kyber and Dilithium. Banks and agencies care before a quantum computer exists for a plain reason. Somebody can copy encrypted files today and sit on them until the lock can be picked. Anything that has to stay secret for ten or twenty years is already in play.
DocuHide’s signature layer uses lattice-based post-quantum cryptography. The whole system rests on what I call the candy store idea. Assume somebody gets through the front door, then make sure getting in doesn’t get them anything worth carrying out. Content a recipient isn’t cleared for isn’t blacked out; it’s removed. There’s nothing to see and no hint that anything was ever there.
Same rule for your website
Most agencies sell you a perimeter. A firewall, a security plugin, a scan, a monthly report with a green checkmark. Cloudflare pushed default firewall rules for PHP2Shell before the public release, which is good, and it’s also a filter guessing what an attack looks like. Cloudflare itself has reported attackers trying to evade those rules. A filter is a layer. It’s not the answer.
The first question we ask on a build is whether the site needs a server-side language at all. Most brochure sites for practices and small businesses don’t. webpro.com is a static site served from Cloudflare. There’s no PHP in the path, so there’s nothing for this attack to land on. That’s what rebuild over retrofit means in practice. You don’t patch your way to safe; you remove the thing that needed patching.
When a client does need PHP, for a store or a membership system or a custom application, we treat the server as the outer wall and plan for it to be tested. Dedicated servers, a team watching them around the clock, hourly backups with a restore measured in minutes, and a clean environment to roll back to if something gets in. The updates are our job, and they sit inside a flat monthly fee. Nobody gets a surprise invoice for a Wednesday emergency.
What to do this week
- Find out which PHP version your site runs on, then confirm your host has moved it to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The fixed releases are all 8.2 or newer, so if you’re on anything older, ask your host what the plan is.
- Ask whether the site needs PHP at all. If the answer is no, that’s the cheapest security upgrade you’ll ever buy.
- Keep an eye out for the next PHP release, since the session upload advisory from Oct. 23 is still waiting on its fix.
PHP2Shell questions, answered
What is PHP2Shell?
PHP2Shell is the name the security industry gave to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on the CVSS v4.0 scale and can allow an unauthenticated attacker to run code on a web server.
Which PHP versions are affected by PHP2Shell?
Every PHP release from 5.4 through 8.5.11. The fixes shipped on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Is PHP2Shell being exploited in the wild?
Yes. Amazon Threat Intelligence logged an exploitation attempt on October 17, 2026, four days before public disclosure, and watchTowr confirmed exploitation in the wild on October 21.
How do I fix the PHP2Shell vulnerabilities?
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply your operating system vendor’s patched package. If you are on a hosting plan, confirm in writing that your host has done it. A web application firewall helps, but it is a filter and not a fix.
Is my WordPress site affected by PHP2Shell?
WordPress runs on PHP, so a WordPress site on an unpatched PHP version is exposed. The flaws are in the PHP interpreter itself, so updating a plugin or theme does not close them. The PHP version on the server has to be updated.
Can a static website be hit by PHP2Shell?
A site that serves only static files and runs no PHP in the request path gives these exploits nothing to land on. That is one reason we build most brochure sites as static sites.
About DocuHide
DocuHide is a document protection system invented by Bennie Warshaw, awarded a U.S. patent in October 2026 and registered under Justified, LLC. It combines per-recipient control over what each reader can see with post-quantum cryptography. Partnership inquiries are welcome through webpro.com.
About WEBPRO International
WEBPRO International Inc. has built websites and organic search strategy since 1994, working with clients from small businesses to Fortune 500 companies and federal agencies. Its turnkey flat monthly fee stays the same regardless of the changes and additions a client requests.
Sources
- Huntress, “Rapid Response: php2shell”
- watchTowr, “PHP2Shell FAQ”
- Cloudflare, “Cloudflare deploys protections against php2shell vulnerability”
- Google Cloud, “Responding to core PHP vulnerabilities”
- Qualys, “PHP2Shell: Find, Mitigate, and Patch Now”
- University of Washington IT, “Critical PHP vulnerabilities (Oct 2026)”
- PHP2Shell, Wikipedia
