Two critical PHP vulnerabilities nearly caused an internet-wide crisis
The PHP2Shell flaws let attackers break into servers running the PHP programming language without a password. Mass exploitation has so far been largely avoided, but many systems remain unpatched.
On Wednesday, 21 October, companies and institutions around the world rushed to update their systems after two critical security vulnerabilities were disclosed in PHP, an open-source web technology. The programming language is widely used to build websites and web apps, and about 70% of the web-facing internet relies on it. The flaws are known as PHP2Shell and are registered as CVE-2026-109618 and CVE-2026-109619.
What the bugs allow
The bugs let an attacker anywhere in the world break into an unpatched system remotely, with no password and without the victim clicking a link or opening a file. This type of risk is called remote code execution. An intruder could plant malware, steal data or establish a long-term foothold in the system.
How it unfolded
The security research firm Calif spotted the bugs in 2024, but they were not considered exploitable at the time and were not fixed. Researchers later found a way to exploit them and alerted the PHP Foundation, the organization that maintains PHP. It kept the patches confidential until a set deadline so that major companies and web hosts could install them ahead of time. Public patches were released on Wednesday.
Banks, retailers, gaming sites, hospitals and some government agencies temporarily took websites or services offline to apply updates. Governments urged citizens and businesses to act.
Exploitation before disclosure
Amazon reported that it detected exploitation about a week before the patches were available, pointing to 17 October. How the attacker learned of the flaws is unclear. The PHP Foundation blamed one company for publishing patches hours before the deadline, but that does not explain the week of activity. By late Friday, Palo Alto Networks and Trail of Bits confirmed compromises. Cloudflare chief executive Matthew Prince said the company had seen a sharp rise in exploitation attempts after disclosure.
What comes next
PHP is also found in routers, storage devices, firewalls and VPN equipment, so updating may take a long time, especially for smaller IT teams and legacy systems. Calif said AI assisted with exploiting the bugs, but the bulk of the work relied on the researchers' own knowledge.
