Over the past 48 hours, multiple security flaws and vulnerabilities have been reported online. While PHP2Shell is still the primary vulnerability that’s got everyone scared, it’s not the only critical bug that was reported in the past two days.
Now, nobody panic! Yes, it’s kinda scary that everything on the internet is breaking at once, but let’s get our ducks in a row before we start unplugging all our electronics and covering our windows with tinfoil. First things first, is it a coincidence that these vulnerabilities have all been reported at the same time, or is there a more sinister explanation for all this? The latter.
I think it’s best to have the experts explain this one, so here are two quotes that I believe put it all into perspective. Firstly, Cloudflare CEO Matthew Prince on X: “In the 10 hours before [the PHP vulnerability] was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
— Matthew Prince 🌥 (@eastdakota) October 22, 2026
Here’s a second quote from Wiz Research, one of the research teams that discovered the PHP vulnerability: “Pre-AI, this manual work would be difficult to implement and even harder to scale[…]This changes the economics of both discovery and exploitation. As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.”
Here’s the dummies guide version: AI has gotten better at detecting vulnerabilities and fixing vulnerabilities. That’s good! But AI has also gotten better at exploiting vulnerabilities, so its improved detection is a double-edged sword. That’s why all these issues are being reported at once, and it’s also why the people reporting them are scared. It might sound a little reductive, but I find it oddly comparable to the Wild West: everyone has a gun now, so we just gotta hope the bad guys have bad aim.
To that end, here’s a roundup of the most pressing “critical” vulnerabilities discovered and reported in the past week. Just keep in mind that there’s a solid chance that in between writing this and hitting publish, more may have been reported.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
All right, let’s start with the big one: PHP2Shell. But what is PHP? It used to be an abbreviation for Personal Home Page, but these days it stands for Hypertext Preprocessor. It’s a programming language used to power websites, mobile apps, data apps, and more.
One piece of info that seems to have been partially overlooked online is that PHP2Shell is actually two vulnerabilities in one: CVE-2026-109618 and CVE-2026-109619. However, both vulnerabilities allow for the same exploit, commonly known as RCE (Remote Code Execution).
In simplest terms, RCE allows someone to run code on your machine remotely, and without your permission. An estimated 70 percent of websites across the internet rely on PHP. This is why the United States’ National Security Agency and the UK’s National Cyber Security Centre suggested that websites go dark until the vulnerabilities are patched.
But Kotaku is primarily a video game website, so how is this affecting games? Well, there are too many examples to list here, but here are a few: Square Enix has reported “confirmed instances of unauthorised access” by third parties, multiple Pokémon apps had to go offline for “emergency maintenance,” and two of Japan’s oldest mobile games will be permanently sunset following the discovery of the PHP vulnerability.
GitLab (CVE-2026-110264)
GitLab, a Git repository manager that’s very similar to GitHub, reported CVE-2026-110264 last night. This is another RCE vulnerability, but there’s an extra-worrying detail to this one: CVE-2026-110264 is rated a 10 out of 10 on the Common Vulnerability Scoring System scale.
For context, the two PHP2Shell vulnerabilities are rated 9.2 out of 10 on the Common Vulnerability Scoring System scale. Sounds weird, right? How the hell is PHP2Shell such a big deal, especially considering that it supposedly threatens 70 percent of all websites, yet GitLab’s CVSS is higher?
From what I understand, the explanation is pretty simple: CVE-2026-110264 is easier to pull off, as the National Vulnerability Database explains that it has a low “complexity” threshold. The issue seemingly only affects GitLab’s pre-2015 versions, up to and including version 7.0. It probably goes without saying, but GitLab “strongly” recommends “that all self-managed GitLab installations be upgraded to one of these versions immediately.”
Plex2Shell (Multiple CVEs)
PHP2Shell is two CVEs in one, but Plex2Shell is four—and yes, the “Plex” part of the name is a direct reference to the streaming company Plex, which boasts over 42 million active subscribers.
Here’s good news upfront: this has been fixed. Here’s the bad news: it’s really, really bad, so if you’re a Plex subscriber, you’d better hope you already updated all your Plex-related software and apps.
Plex reported the vulnerabilities at the start of September, but we only received the CVEs for them on October 20: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The short explanation is that all four of these vulnerabilities combine into a big one that, you guessed it, allows for remote code execution.
According to Plex, it has observed multiple attacks over the past month, and most commonly people are using the vulnerability to turn people’s Plex servers into cryptocurrency miners: “Compromised servers have been used to run cryptocurrency miners and proxy software, which routes other people’s traffic through the victim’s internet connection.”
