PHP2Shell and the new normal in IT security

In October 2026, two critical vulnerabilities known as “PHP2Shell” became public in PHP, the programming language behind a large share of all web applications worldwide – including TYPO3, WordPress, Drupal and Nextcloud. The German Federal Office for Information Security (BSI) published an IT security advisory (in German) rated “orange” (as of 22 October 2026): measures must be taken without delay.

What happened

The vulnerabilities CVE-2026-109618 and CVE-2026-109619 are rated 9.2 out of 10 and are referred to as “PHP2Shell” – a nod to “Log4Shell”. According to the BSI, all known PHP versions back to at least PHP 5 are affected. Attackers could execute malicious code on web servers remotely, without authentication and without any user interaction. The PHP developers released patches on 21 October 2026. The vulnerabilities are fixed from versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 onwards. According to the BSI, only patching or disconnecting from the internet offers complete protection; web application firewall rules can at most bridge the time until the update.

How we responded

We operate a number of critical systems for our clients and for our own products. We responded immediately: all vulnerable systems were taken offline, patched and only then brought back online. That this works quickly and in an orderly way is no coincidence – it is the result of processes we have prepared for exactly such cases.

The new normal

We believe we are now in a new normal: security problems like this one will occur in quicker succession and with greater impact. The reason is that gaps in standards and code can be found and exploited with the help of AI more easily than ever before.

The current case shows both sides: according to the BSI, security researchers together with OpenAI were involved in discovering the vulnerabilities. At the same time, the BSI notes that attackers can use AI-supported tools to analyse patches and generate exploits within a short time. Often only hours remain between the release of a patch and the first attacks.

AI against AI: responding fast and flexibly

This development can only be countered with systems and workflows that use AI themselves – to respond with sufficient speed and the necessary flexibility. Anyone who has to assess vulnerabilities within hours, identify affected systems, apply patches and document everything traceably can no longer keep up with purely manual processes.

TPWD AG has been adapting its structures to this scenario for some time. The backbone of this development is srfce: an AI-native system for project management and documentation that also steers the behaviour of AI – based on fixed requirements, technical and content guardrails, and our experience.

People stay accountable

AI speeds up analysis, implementation and documentation. Decisions and approvals, however, remain with experienced people. Especially under time pressure, clear responsibilities are essential: who assesses the risk, who decides to take a system offline, who approves the return to operation? The guardrails in srfce ensure that AI works within these roles – not around them.

Legacy systems are the biggest risk

The BSI points out that a very large number of vulnerable systems are still reachable worldwide – often because they reached end-of-life long ago and no longer receive any updates at all. No patch helps against such gaps. Anyone who operates systems over many years therefore needs lifecycle planning: timely platform updates, planned migrations and the courage to replace legacy systems before they become a risk.

Operation is an ongoing task

Security is not created at launch but in day-to-day operation (more under Privacy & security): through monitoring, rehearsed processes, on-call readiness and transparent communication with everyone involved. Cases like PHP2Shell show how important it is to have these structures in place before they are needed.

An industry in transition

Our industry is undergoing profound change. Our decades of experience in planning and operating extensive systems and our own products help us to recognise the central challenges and develop working solutions at high speed.