Explained
PHP2Shell: what it is, who decides and what changes for the region
Two critical flaws in the PHP engine, found with AI and exploited at scale within hours, test how fast companies and public institutions in Central America and the Caribbean can decide.
On Wednesday, October 21, the PHP project shipped a patch and, according to Cloudflare, the next 45 minutes brought tens of thousands of attack attempts. Two hours later it was hundreds of thousands, and by that same night, millions. That is how short the window to react was.
What PHP2Shell is
PHP2Shell is the name given to two flaws in the PHP engine itself, the language behind WordPress, Drupal, Joomla and a great many institutional websites. They are registered as CVE-2026-109618 and CVE-2026-109619 and carry a severity of 9.2 out of 10.
The serious part is what they allow: running code on the server with no username or password. They affect almost every version of the last decade, back to 5.4. Wiz demonstrated attacks against WordPress, Drupal and Joomla, and warns that even a minimal page on an affected version can be vulnerable. Palo Alto Networks counts 22.6 million potentially exposed installations.
How AI found them and how fast they were exploited
This is the part I find most telling. The firm Calif found the first flaw on August 1 using an OpenAI model. Wiz got to both on its own on August 19, with Google and OpenAI models plus an agent of its own, and sums it up this way: one researcher did in a week what used to take a top team months.
The report reached the PHP project on August 24 and the patch came out on October 21. From that moment the race changed sides. AWS says the flaw is being broadly exploited, and Cloudflare's curve suggests the other side is working with automation too.
Who decides and what the rules say
The official guidance is easy to read and hard to execute. PHP asked everyone to update now to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to take the site offline until they can. CISA asked to disconnect whatever cannot be updated, especially anything running PHP 8.1 or unsupported versions.
Several governments took that guidance literally. The Netherlands and Finland took government sites offline as a precaution. In Costa Rica, MICITT alerted every public institution, with a direct message to directors, IT heads and cybersecurity liaisons. That is what a national CSIRT is for: turning a global alert into an instruction with a name and a date.
What changes for companies and public institutions in the region
For a company or public entity in Central America and the Caribbean, PHP2Shell leaves three concrete questions, and none of them is technical. The first is whether you know how many of your sites run PHP and on which version. The second is whether someone has written authority to take a public portal offline without waiting for a meeting. The third is whether there is a channel through which an alert like MICITT's reaches, within hours, the person who can act.
Where the gap is
The patch has existed since Wednesday and it is free. The gap I see has more to do with governance and decision speed than with technology. A CSIRT with a real mandate, an up-to-date inventory and one person with signed authority to disconnect a service solve more than any new tool.
And the clock is no longer set by the defender. If AI cuts the time to find a flaw like this from months to a week, organizations that still need three signatures to take a site offline will be late every single time.
Who holds that authority in your institution today?
Sources
Wiz: technical analysis of PHP2Shell
Fortune: how AI tools found the flaw
CISA via N+: alert on attacks against websites