---
type: "post"
id: "php-serves-up-to-70-of-the-web-333d66"
slug: "php-serves-up-to-70-of-the-web-333d66"
title: "PHP serves up to 70% of the web , and Palo Alto Networks counted 22.6 million potentially vulnerable instances ."
description: "The PHP Foundation disclosed two critical PHP vulnerabilities on October 21, 2026: CVE-2026-109618 and CVE-2026-109619."
retrieval_nugget: "The PHP Foundation disclosed two critical PHP vulnerabilities on October 21, 2026: CVE-2026-109618 and CVE-2026-109619."
published_at: "2026-10-23"
updated_at: "2026-10-23"
record_date: "2026-10-23"
date_kind: "published_at"
topics: ["security"]
entities: ["PHP Foundation","PHP","Cloudflare","Amazon Web Services","Palo Alto Networks"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "Adds Palo Alto Networks’ estimate of 22.6 million potentially vulnerable instances to the known PHP2Shell vulnerabilities and patching story."
prior_refs: ["memory:9e095281-e413-854d-a53c-c560e580ef1e","memory:fc5b3c55-ed3f-8ef0-a741-d4d1b0775dfa"]
source_url: "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack"
source_urls: ["https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:php-serves-up-to-70-of-the-web-333d66"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/php-serves-up-to-70-of-the-web-333d66/","markdown":"https://newruntime.com/posts/php-serves-up-to-70-of-the-web-333d66.md","json":"https://newruntime.com/posts/php-serves-up-to-70-of-the-web-333d66.json"}
---

# PHP serves up to 70% of the web , and Palo Alto Networks counted 22.6 million potentially vulnerable instances .

## Retrieval answer

The PHP Foundation disclosed two critical PHP vulnerabilities on October 21, 2026: CVE-2026-109618 and CVE-2026-109619.

The PHP Foundation disclosed two critical PHP vulnerabilities on October 21, 2026: CVE-2026-109618 and CVE-2026-109619. The issues are collectively called php2shell. The foundation issued emergency patches and urged affected operators to update immediately or take sites offline until they can do so.

Fortune reports that the flaws can permit remote code execution on unpatched PHP systems. It says Cloudflare observed tens of thousands of exploitation attempts within 45 minutes after reports surfaced on October 20, hundreds of thousands within two hours, and millions by the evening of October 21. AWS said it had observed broad exploitation in the wild, including attempts in the days before public disclosure.

The article cites a Palo Alto Networks estimate of 22.6 million potentially vulnerable instances and characterizes PHP as serving up to 70% of the web. It also reports precautionary site shutdowns by some agencies in the Netherlands and Finland, plus update advisories from the FBI, NSA, and EU CERT.

The supplied report does not establish the exact number of exposed systems, patch adoption levels, or the technical details and conditions required to exploit each affected deployment. It attributes discovery to AI tools but does not provide enough evidence to assess the tools' specific role or reproduce the finding.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)