What happened
On October 21, 2026 the PHP project patched CVE-2026-109618 and CVE-2026-109619, use-after-free flaws dubbed PHP2Shell that let an unauthenticated request run code on servers using PHP-FPM, mod_php, php-cgi, FrankenPHP or LiteSpeed. Wiz Research, which disclosed them, says AI models helped build the exploits. The Canadian Centre for Cyber Security issued alert AL26-026 the same day and on October 23 added CVE-2026-115560, a related flaw with no patch yet; it notes a public proof of concept but no active exploitation so far. (Canadian Centre for Cyber Security, alert AL26-026, Oct. 23, 2026)
Note on figures: The claim that AI models helped build the exploits comes from Wiz Research, the vendor that disclosed the flaws.
What it means for Canada
The Cyber Centre directed this alert at Canadian IT teams. PHP runs a large share of web apps, so Canadian retailers on WordPress or WooCommerce, government and municipal sites, universities, hosting providers and SaaS firms with internet-facing PHP are exposed until patched, along with appliances and containers that bundle PHP.
- Sectors
- Retail and e-commerce · Government and municipalities · Universities and colleges · Web hosting providers · SaaS and software firms · Media
- Tools involved
- PHP 8.2 to 8.5 before the fixed releases · WordPress, WooCommerce, Drupal and other PHP apps · PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed · Appliances and containers that bundle PHP
- Canadian rules
- PIPEDA: a server takeover that exposes customer data triggers breach reporting to the Privacy Commissioner when there is a real risk of significant harm
Quebec Law 25: confidentiality incident register and notice to the CAI
Bill C-8 (Critical Cyber Systems Protection Act): designated operators must manage vulnerabilities and report cyber incidents to the Cyber Centre
OSFI B-13: timely patching of internet-facing systems at federally regulated financial institutions
Takeaways for Canadian businesses
- BusinessUpgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, starting with internet-facing servers; PHP 8.1 and older get no fix from the PHP project, so get a vendor backport or move to a supported version.
- BusinessSet session.upload_progress.enabled=0 in php.ini as the PHP Security Team advises, which also covers the still-unpatched CVE-2026-115560.
- BusinessInventory third-party appliances, hosting control panels and container images that bundle PHP, using NCSC-NL's php2shell software list on GitHub, and chase each vendor for a patch.
- BusinessIf you cannot patch right away, isolate the internet-facing app, and review web server and endpoint logs for unexpected processes, files, accounts or outbound connections from PHP.
- BusinessReport any matching activity to the Canadian Centre for Cyber Security through My Cyber Portal or contact@cyber.gc.ca.
For the Canadian AI sector
PHP2Shell is a clear case of AI speeding up both bug finding and exploit building, which shortens the window between disclosure and attack. Canadian AI teams should also check agent skills and coding agents that install PHP, since researchers found dozens still pulling vulnerable versions.
Written by AgentsNorth from the source below. General information, not legal or security advice.