Live Feeds
● LIVE Updated 1h ago · 12 sources tracked

Websites across world hit by millions of attempts to exploit PHP code flaw

Websites around the globe are facing millions of attempts to exploit newly disclosed vulnerabilities in PHP, the web programming language that underpins 70% of the internet. Threat actors are targeting critical remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS scores of 9.2, through specially crafted HTTP requests. In response to the threat, governments and corporate operators are taking websites offline to apply security patches. In the United Kingdom, 32 government services have been made unavailable while security work takes place, though Downing Street notes this does not mean they were hacked.

🎙️

Listen to Live Briefing

Real-time synthesized voice briefing · Live Feeds Desk

⏱ ~3 min
Speed:
RSS Source map (12)
⚡ Key Developments & Real-Time Context
Text size:
  • ✓ Websites across the world have been hit by millions of attempts to exploit critical PHP code flaws.
  • ✓ The vulnerabilities allow unauthenticated remote code execution via specially crafted HTTP requests and are tracked as CVE-2026-109618 and CVE-2026-109619, both carrying CVSS scores of 9.2.
  • ✓ Patches have been released in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • ✓ In the United Kingdom, 32 government services were made unavailable as security work took place, with Downing Street stating this does not mean they were hacked.
🛡️ Source Corroboration: 12 independent reporting domains (95% confidence) ⏱ Read time: ~3 min

What changed

Threat actors have launched millions of unsuccessful attempts to exploit the PHP2Shell vulnerabilities to rope systems into a Mirai botnet variant called Potassium, while analysis shows that weaponizing the flaws may be harder than initially thought.

Live updates

  1. Millions of Exploit Attempts Hit Global Websites Following PHP Flaw

    Websites around the globe are facing millions of attempts to exploit newly disclosed vulnerabilities in PHP, the web programming language that underpins 70% of the internet. Threat actors are targeting critical remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS scores of 9.2, through specially crafted HTTP requests. In response to the threat, governments and corporate operators are taking websites offline to apply security patches. In the United Kingdom, 32 government services have been made unavailable while security work takes place, though Downing Street notes this does not mean they were hacked.

    Why it matters

    The global cybersecurity response was triggered after artificial intelligence uncovered critical remote code execution vulnerabilities in the PHP programming language, which affects a vast majority of internet sites. Operators worldwide are scrambling to secure infrastructure against exploitation attempts that seek to rope infected systems into botnets. Software maintainers have released patches for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the fault.

    What is confirmed

    • Websites across the world have been hit by millions of attempts to exploit critical PHP code flaws.
    • The vulnerabilities allow unauthenticated remote code execution via specially crafted HTTP requests and are tracked as CVE-2026-109618 and CVE-2026-109619, both carrying CVSS scores of 9.2.
    • Patches have been released in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
    • In the United Kingdom, 32 government services were made unavailable as security work took place, with Downing Street stating this does not mean they were hacked.

    Still unconfirmed

    • Attackers are attempting to rope infected systems into a Mirai botnet variant called Potassium.

    What to watch next

    • Widespread adoption of the patched PHP versions across enterprise and government web servers.
    • Further technical analysis on whether threat actors can successfully overcome the difficulty of weaponizing the PHP2Shell flaws.
    Sources used for this update (13)
    1. help.naver.com — Futures Flat As Oil Rebounds After Trump's "Energy Ceasefire" Unravels, Memory Stocks Slide | ZeroHedge
    2. fortune.com — Hachette’s CEO says AI shortcuts are creating a ‘worse C-suite'
    3. timesofindia.indiatimes.com — Saudi Arabia Turns To Iran Amid Houthi Strikes, Dealing Trump A Major Gulf Blow? - Times of India Videos
    4. www.theguardian.com — AI godfather Geoffrey Hinton: ‘We’re creating alien beings. I’m willing to be selfish and choose humans’ | Donald Trump
    5. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
    6. AP News — Some websites go dark as operators address an AI-detected flaw in a web programming language
    7. CNN — Websites shut down globally after AI finds a critical flaw affecting 70% of the internet
    8. The Guardian — Websites across world hit by millions of attempts to exploit PHP code flaw
    9. The New York Times — What Is PHP? Why Are Government and Business Websites Going Offline?
    10. www.bbc.co.uk — Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live - BBC News
    11. economictimes.indiatimes.com — What is a PHP vulnerability? Security flaws prompt shutdowns of major websites amid global cybersecurity response - The Economic T....
    12. www.theguardian.com — Websites across world hit by millions of attempts to exploit ...
    confidence 95%
📊

Community Sentiment: How do you assess this situation?

Voice your perspective · Real-time aggregated sentiment from the Live Feeds community