web infrastructure

Two dormant PHP flaws, dubbed PHP2Shell, trigger global scramble to patch

Two critical vulnerabilities in PHP, the open-source web language underpinning most of the internet, briefly threatened mass exploitation before patches landed on Wednesday. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow password-free access to websites and internet-facing servers.