The Day the (Digital) World Ended Before Noon
Every disaster movie starts the same way.
Someone is making breakfast while the radio mentions something odd: a distant tremor, a bird flying the wrong way. The protagonist doesn’t pay attention. By the time they understand what’s happening, it’s already too late.
On October 21, I was that protagonist. Except instead of a radio, I had my phone.
7:40 a.m. — The first tremor
I started the coffee maker and opened the news: two critical vulnerabilities in PHP.
For the people who don’t live in this world: PHP is the language a huge part of the internet runs on. WordPress, WooCommerce, online stores, client portals. If your site has a form, a shopping cart or a login, there’s a good chance PHP is behind it.
I thought what the protagonist always thinks in the first scene: “it’s probably nothing.”
It wasn’t.
8:15 a.m. — Sirens in the distance
By the second cup, it had a name: PHP2Shell. When a vulnerability gets its own name, you know it’s not going to be a quiet morning.
There were two flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. Both allow unauthenticated remote code execution: an attacker could cause a vulnerable server to execute malicious code without first logging in. A specially crafted request, potentially submitted through an exposed form, could be enough under vulnerable conditions.
The first, CVE-2026-109618, has to do with memory. Before your site even reads what someone sent, PHP is already arranging that data internally. If an attacker sends something designed to exhaust memory during that process, PHP can mishandle the cleanup and potentially execute attacker-controlled instructions.
Picture a waiter who runs out of notepad halfway through an order. He tears off the page and walks away. Whoever clears the table finds the unfinished page and does what the last line says. The customer wrote that line.
The second, CVE-2026-109619, is more unsettling. A PHP process may serve many requests in sequence, and the flaw can allow information from one request to persist into another. It’s like a hotel where the next guest walks in before housekeeping does: on the nightstand are the previous guest’s key, their notes and, sometimes, their passwords. Depending on the circumstances, sensitive information such as credentials or access keys could be exposed.
Affected versions go back to PHP 5.4 and include vulnerable releases through PHP 8.5.11. More than a decade of the internet.
9:30 a.m. — The shelter
I walked into my first meeting with a news tab I didn’t dare close. That’s when the first good news arrived: Cloudflare announced that its firewall was blocking known PHP2Shell exploit attempts by default, including for customers on free plans whose traffic passes through its WAF. It had detected attack activity before public disclosure.
It was like finding out the city has a wall before the horde arrives. But the wall isn’t the cure: the vulnerability remains in the server until PHP is patched. And attackers can continue adapting their requests to evade defensive rules.
12:00 p.m. — The morning kept going
The PHP maintainers made the priority clear: firewall rules are not a substitute for installing the security updates. The fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Sites running older, unsupported branches need to move to a supported version or obtain a verified vendor-maintained patch.
We spent the day doing what a team does when the alarm goes off: taking inventory of PHP versions, prioritizing exposed servers, checking that firewall rules weren’t set to log-only, updating and testing.
In the movies, the catastrophe is rarely one villain’s fault. It’s the sum of things that moved faster than anyone could control.
Artificial intelligence has given us a speed that seemed impossible a few years ago. We use it every day. But that speed doesn’t belong only to the people building things. In July, a researcher asked an AI model to audit WordPress’s code, and in just over ten hours the model identified a chain of flaws that could lead to site compromise. The same tools that help us build faster can also help others identify weaknesses faster. Add AI-generated code that nobody reviews with professional judgment: new doors, left open without anyone noticing.
This is not an argument against AI. It’s an argument for what surrounds it: a team that understands what a CVE means when it shows up in the news at seven in the morning, knows which version runs on every server, and has an action plan before the alarm goes off.
The difference between a disaster movie and an ordinary day isn’t whether the threat exists. It’s who was ready when it arrived.
Tools change. What doesn’t change is that someone has to be ready when something breaks. If you want to see how we look after our clients’ systems, before, during and after a day like this one, you’ll find us at inflexionsoftware.com.
