Two critical vulnerabilities in PHP, the decades-old open-source language that powers a huge share of the web, forced a global patching scramble this week after researchers found a way to exploit code that had sat dormant for years. The bugs are dubbed PHP2Shell and officially tracked as CVE-2026-109618 and CVE-2026-109619, according to TechCrunch.
The PHP Foundation, which maintains the software, released patches on Wednesday that close the holes on web-facing servers. It had already shared the fixes under embargo with major internet companies and hosting providers, a coordinated disclosure that so far helped the world avoid mass exploitation. Even so, researchers warn that many systems remain unpatched and vulnerable, and that this is unlikely to be the last scare of its kind.
What PHP2Shell actually does
The flaws were first spotted in 2024 but were not considered exploitable at the time, so they were never patched. Researchers recently worked out how to weaponize them and alerted the PHP Foundation, which then ran a tightly guarded fix and disclosure process, TechCrunch reported.
- Remote code execution: attackers can hit a server over the internet without the victim clicking a link or opening a file.
- Unauthenticated access: no password or other credentials are needed to break in.
- Full control: an unpatched system can be used to plant malware, steal data or keep a long-term foothold.
- Wide reach: roughly 70% of web-facing internet infrastructure relies on PHP, including WordPress, Drupal, Joomla and MediaWiki, which powers Wikipedia.
