PHP2Shell: Critical PHP vulnerabilities patched, update now!

Live updates

1. 58m ago

   PHP2Shell: Critical PHP vulnerabilities patched, update now!

   The PHP development team has released emergency security updates to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These unauthenticated Remote Code Execution (RCE) flaws affect PHP and put numerous websites at risk. Updates have been released to address these vulnerabilities, and website operators are urged to apply them immediately.

   Why it matters

   The PHP2Shell vulnerabilities impact a significant portion of the internet, with an estimated 70% of websites using PHP. The vulnerabilities allow for unauthenticated RCE, making them particularly dangerous. As a result, many websites, including government and corporate sites, have taken emergency measures to address the issue.

   What is confirmed

   • The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
   • PHP2Shell vulnerabilities affect 70% of the Internet.
   • The vulnerabilities allow for unauthenticated Remote Code Execution (RCE) in PHP.
   • Many websites, including government and corporate sites, have taken emergency measures to address the issue.

   Still unconfirmed

   • Vulnerabilities on the scale of PHP 'still coming,' warns Cloudflare CEO.

   What to watch next

   • Further updates on the extent of the damage caused by the PHP2Shell vulnerabilities
   • Assessment of the long-term impact on internet security
   • Release of additional patches or updates for related vulnerabilities
   Sources used for this update (19)

   1. Ars Technica — PHP warns it plans to release 2 emergency patches imminently
   2. Reuters — EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities
   3. National Cyber Security Centre — Critical security issue affecting PHP
   4. BBC — Cyber chiefs tell websites to make critical safety update or go offline
   5. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   6. Cloudflare Blog — Cloudflare deploys protections against php2shell vulnerability
   7. Help Net Security — PHP2Shell: Critical PHP vulnerabilities patched, update now!
   8. CNBC — Government websites in Europe and elsewhere go dark as software flaw sparks security scramble
   9. AP News — Some websites go dark as operators address an AI-detected flaw in a web programming language
   10. OpenAI — Patch the Planet: global response coordination as agents uncover critical vulnerabilities
   11. The Guardian — Flaw in PHP computer language leads to shutdown of websites around world
   12. 10TV — Massive security flaw detected in web programming language forces many websites offline
   confidence 95%