Key insights
- PHP has released emergency patches for critical remote code execution vulnerabilities affecting an estimated 70% of websites. Cloudflare, whose Web Application Firewall acts as a primary defense, saw its stock surge as investors recognized its mitigation role. The company has deployed WAF rules to protect customers while urging them to apply the official patches. Other cybersecurity stocks like CrowdStrike and Palo Alto Networks also experienced gains.
Investing.com -- PHP released emergency patches today fixing two critical remote code execution vulnerabilities rated CVSS v4.0 9.2, affecting every web server running PHP 5.4 or later — a population spanning an estimated 70% of the world's websites.
The flaws, collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were patched in four simultaneous releases: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Cloudflare Inc (NYSE: NET) is one stock most exposed to this crisis: its Web Application Firewall is the frontline commercial barrier between attackers and millions of PHP sites, and the stock is trading at $307.79, up $16.10 (+5.52%) intraday on Wednesday as investors price in the company's prominent mitigation role. Other cybersecurity stocks, like CrowdStrike and Palo Alto Networks, are also up.
The trouble started before the patch even shipped. Cloudflare logged the first attacks against PHP sites at 07:43 UTC on October 21, hours before the official patch window opened at approximately 14:00 UTC. Details of the vulnerabilities had leaked publicly on October 20, one day ahead of the coordinated embargo date, forcing the PHP security team to accelerate its release timeline, according to background reporting from sansec.io.
Cloudflare CTO Dane Knecht moved quickly. "PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free," he said. Knecht added that the WAF rules are "a STOPGAP only" and urged site operators to apply the official patches as soon as possible, noting the company was updating mitigations as new attack vectors emerged.
The technical stakes are high. CVE-2026-109618 not only enables remote code execution but also carries a Heartbleed-style memory leak capable of exposing passwords, session tokens, API keys and TLS private keys from other server requests — without the application ever calling session_start(), per sansec.io. That combination of code execution and passive credential harvesting makes these vulnerabilities particularly dangerous for shared-hosting environments running WordPress, Drupal, Joomla or Magento.
Governments are already pulling sites offline as a precaution. Reuters reported that cybersecurity agency websites in the Netherlands and Finland went dark, including, ironically, the Dutch National Cyber Security Centre itself. The Dutch House of Representatives and security news site Security.NL also suspended operations. Cybersecurity agencies across Europe, Australia, Japan and Britain urged PHP operators to update immediately or take their sites offline.
The origins of the discovery carry a notable subplot. OpenAI said its GPT-5.6 Sol model independently found CVE-2026-109618 through its "Patch the Planet" initiative in August 2026, while Wiz Research independently discovered and reported both flaws. OpenAI framed the AI-first discovery as a "Defender's Window", a coordinated interval in which fixes can be deployed before criminal actors weaponize the same finding.
One critical gap remains: PHP versions 8.1 and earlier receive no official fix. The PHP security team released minimal source backports for PHP 7.4, 8.0 and 8.1 for those building from source, but end-of-life installations running on commercial hosting stacks are permanently exposed unless operators take independent action. "So many embedded installations out there that will never be patched. Too many forgotten, unmaintained apps. There will be a long tail for this one," computer forensics expert Hal Pomeranz said, as quoted by helpnetsecurity.com. Security researcher Kevin Beaumont was equally blunt: "The PHP situation will lead to a mass of incidents, it's one of the biggest vulns in years."
Two near-term catalysts will determine how this story develops. First, a formal listing on the CISA Known Exploited Vulnerabilities catalog would trigger mandatory patching deadlines for U.S. federal agencies and would likely accelerate enterprise adoption of WAF services, a direct revenue tailwind for Cloudflare. Second, major managed-hosting providers including WP Engine, Kinsta and SiteGround have not yet confirmed rollout timelines for the updated PHP packages; any delay in pushing patches to shared-hosting customers extends the window of exposure and keeps demand for WAF-layer protection elevated. If new exploit variants surface that bypass the initial WAF rules Cloudflare has deployed, a follow-on PHP patch release could arrive before the end of the week, potentially triggering a second wave of emergency upgrades across the internet's server base.
Original Article