Business / news
Two dormant PHP flaws, dubbed PHP2Shell, trigger global scramble to patch
Two critical vulnerabilities in PHP, the open-source web language underpinning most of the internet, briefly threatened mass exploitation before patches landed on Wednesday. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow password-free access to websites and internet-facing servers.
The vulnerabilities had lain unnoticed for years until researchers working out how to trigger them found a route in. Once exploited, they let an attacker reach an online system running PHP — a website or a public-facing server — and read or alter its data without any credentials.
The maintainers at the PHP Foundation published fixes on Wednesday, and installing them blocks attacks against exposed servers. Larger internet companies and web hosts that depend on the language were given a head start on patching before the public release, part of weeks of behind-the-scenes coordination across the industry.
Even so, the disclosure set off urgent remediation work worldwide, with millions of operators racing to update systems before malicious actors could take advantage. Governments began urging citizens and companies with websites to take mitigating steps on their own infrastructure.
Some organisations went further, shutting down websites and pulling services offline while they applied the patches. So far the coordinated rollout has broadly prevented mass exploitation of the bugs, which carry the joint nickname PHP2Shell.
PHP is a decades-old open-source technology that still powers the majority of the web, making flaws in it unusually consequential for businesses that run storefronts, content sites and backend services on the language.