October 21, 2026

Introduction

On October 21, 2026, PHP’s maintainers released emergency fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which were identified through the use of AI. Within hours, government agencies in several countries told operators to consider taking sites offline until they could patch. They also took down their own websites, government websites in Finland and Edinburg council and the BBC all took down webpages as well as countless others.

So did the administrators of popular darknet forums BreachForums, DarkForums, and PwnForums.

What is PHP

PHP, which stands for PHP: Hypertext Preprocessor, is a free, open-source server-side scripting language designed specifically for web development.

Unlike client-side languages like HTML, CSS, or JavaScript that run inside your web browser, PHP code runs entirely on the web server. When a user requests a page, the server processes the PHP code to dynamically assemble the content (such as pulling data from a database), translates it into standard HTML, and sends the finished page back to the user’s browser.

The security company Wiz estimates PHP powers about 70% of the world’s websites.

What happened

Both identified flaws allow remote code execution. PHP rated each one CVSS 9.2, and CERT-EU says a score at that level implies exploitation without authentication, according to SecurityWeek. Public reporting suggests every PHP version from PHP 5 onward is affected. The NSA said flaws like these “often provide a direct path to the server’s file system or database.”

Researchers found the bugs using OpenAI’s GPT-5.6 Sol model, and Wiz independently found them with frontier AI models, per Cybersecurity Dive. SecurityWeek reports that details surfaced online before PHP’s scheduled coordinated disclosure. PHP had planned patches for 14:00 UTC on October 21 and released emergency updates that day.

The response went well beyond routine patching. Government agencies in the U.K., Canada, Australia and the EU (CERT-EU) urged operators to take sites offline until they could update PHP. Finland’s government and the Dutch House of Representatives disconnected their sites that same day. One researcher estimated that more than 1.3 million websites are vulnerable.

How the Darknet responded

Three major forums went dark as well. BreachForums, DarkForums and PwnForums are offline as of writing while their operators wait for PHP to be patched. Administrators announced the outages on Telegram on October 21.

The BreachForums moderator, posting as HasanBroker, wrote: “BreachForums will be offline for a little while until PHP is patched globally, we take our security seriously.” DarkForums posted: “DF will remain offline until PHP has been patched globally.”

With their sites down, operators then fell back on Telegram, a darknet-adjacent platform, to reach their communities and inform them about why the sites were down. These Telegram channels are often used to share messages and updates on the sites as well as publicize new ventures and leaks of note. 

Many dark web forums run on the same software stack as the legitimate internet, and when the stack breaks, criminal communities scramble to patch it immediately, just like corporate and government communities. Remote code execution would let an attacker run commands on the forum’s server and reach its database, which holds member emails, IP addresses, private messages and the administrators’ own details. 

Although they often share this kind of data from victims, darkweb forum admins take the security of their site seriously for fear of law enforcement action, such as site seizures or alleged honeypot operations. Additionally, competitors and rival forums within the darkweb community have historically exploited vulnerabilities and exfiltrated data for their own gains.

Why it matters beyond the forums

The forum outages are the visible part. The larger effect is what remote code execution on a PHP server does to the data economy behind them. An attacker who runs code on a web server can often reach its file system and database, which is where customer records, credentials and internal documents live. That data does not stay on the compromised server, and may surface later on darknet markets, forums and leak sites.

While Vision has not yet shown stolen data tied to these CVEs, past mass-exploitation events give us a reason to watch for it, and why darknet forum operators are “taking security seriously.”

What defenders should do now

• Patch PHP. Update every PHP deployment to the fixed release, and take systems offline if you cannot patch promptly, as the U.K., Canadian, Australian and EU agencies advised.
• Find PHP you did not know about. Check CMS platforms, plugins, internal tools and vendor-hosted portals. The exposure is in third-party software as much as your own.
• Hunt backward. Details circulated before the patches shipped, so review web server logs and file systems for web shells and unexpected child processes from October 20 onward.
• Watch the darknet for downstream exposure. Monitor for your domains, employee credentials and customer data, and for the vendors that host your PHP applications.

Darknet monitoring matters most at step four. Patching closes the door, but it does not tell you whether someone walked through it first. DarkOwl Vision indexes the forums, markets, chats and leak sites where stolen data appears, so security teams can detect exposure before it is misused.

Sources

Sources

• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws, SecurityWeek
• PHP website vulnerabilities, Cybersecurity Dive
• Forum announcements: Telegram posts by BreachForums and DarkForums administrators, October 21, 2026
• DarkOwl Vision collection: search results from October 14 to October 21, 2026, leak context records for the eight forum database leaks above, and site context records for the three forums

Don’t miss anything from DarkOwl. Follow us on LinkedIn.