The Computer Incident Response Team of Cameroon (CIRT.cm) alerts Cameroonian organisations to the disclosure, on the 19 October 2026, of several critical vulnerabilities affecting the PHP language engine. Grouped under the code name PHP2Shell, these flaws allow an unauthenticated attacker to execute arbitrary code on a web server, regardless of the application running on it.

Millions of servers affected

PHP powers around 70% of websites worldwide, including WordPress, Drupal, Joomla and MediaWiki, the infrastructure that runs Wikipedia. Every version released since PHP 5.4 is affected. A flaw in the engine therefore concerns millions of servers, whatever the quality of the application code they host. Even a simple program that prints “Hello world” is vulnerable if it runs on an unpatched version.

Flaws uncovered with the help of AI

The vulnerabilities were discovered by the Wiz research teams, supported by the latest generation of artificial intelligence models. They had been lying dormant in the codebase for more than ten years. What has changed is the cost of exploitation: where a human researcher had to chain several bugs and adapt an exploit to each memory layout, an AI model now does it in a few hours.