Most people have never heard of PHP, but it plays a major role in web development. This week, two flaws, CVE-2026-109618 and CVE-2026-109619, raised serious security concerns for website owners and visitors worldwide. Together, they’re known as PHP2Shell, and they let an attacker run code on a server without logging in.
The bugs sit in PHP itself, so the risk isn’t limited to careless sites. It affects any site running a vulnerable version, and governments have already taken sites offline to install the fix. Here’s how PHP ended up at the center of it, and why your site may be more exposed than you think.
Web Runs on a Language Most People Never See
PHP helps to create the web pages you see every day. According to cybersecurity firm Wiz, PHP powers about 70% of the world’s websites, including Wikipedia, online shops, and WordPress sites, as reported by the BBC. Many blogs and business sites, and even Wikipedia, are built on it. If PHP has a problem, it can quickly affect businesses, including online stores, news websites, and company portals. Therefore, web security checks are important.
Attacks Started Before the Patch Even Existed
Latest cybersecurity threats often appear before a fix is ready. A patch for this PHP flaw was planned for October 22, but after details leaked, PHP released it a day early. On October 20, a researcher at Calif accidentally posted a video showing a working exploit. Although it was removed quickly, copies had already spread.
Amazon Threat Intelligence recorded an attack attempt on October 17, several days before a patch was available. These bugs had been in PHP for over ten years. Researchers used AI tools to find them, and according to Wiz, these tools have made it much easier to create working exploits.
The PHP Security Flaw You Must Look Out For
PHP2Shell refers to two bugs, CVE-2026-109618 and CVE-2026-109619, found in PHP’s runtime. This makes them hard to spot. Even if your code is clean, you could still be at risk.
Here’s what happens. Sometimes PHP runs out of memory in the middle of a request and leaves behind leftover data.
The cleanup code then treats this leftover data as if it were normal. The second bug is similar: a worker process reuses data from a previous request after its memory has already been freed. With these two bugs, an attacker can attack without logging in. So, website servers running PHP as an Apache module have the highest risk.
Global Cybersecurity Alert Prompts Government Website Shutdowns
After the PHP security flaw was discovered, governments had two choices: patch quickly or take their sites offline. None of the governments listed here have confirmed a breach, but that doesn’t mean they weren’t affected.
- In the Netherlands, the national cybersecurity agency took its own site offline, and the lower house of parliament was also affected.
- In France, the Interior Ministry put prefecture websites into maintenance mode, including the Paris Police Prefecture’s online resource.
- In Germany, the federal IT service ITZBund took several portals offline. Berlin’s Charité hospital also took its website offline.
- In Finland, the state IT provider Valtori shut down public government web services.
- In Belgium, the foreign ministry took its websites offline, even though the national cyber center reported no attacks on Belgian sites.
- In the United Kingdom, 32 government services went offline, and four more were partly disrupted. Edinburgh council and Scottish health boards also took their services down.
- In Japan, Prime Minister Sanae Takaichi urged site owners to check for PHP and said that a temporary shutdown could reduce the risk.
- The United States took a different approach. The NSA advised organizations that couldn’t patch quickly to take their systems offline.
Protect Your Website from PHP Security Flaw
If you’ve run into this bug and don’t know what to do, here’s what you should try. Start by checking your PHP version. Run “php -v” and “php-fpm -v” since your web server and command line might use different versions. After that, update both to one of the fixed versions: 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
After you upgrade, restart PHP-FPM or Apache. Otherwise, the old code will keep running. Versions like 8.1, 7.x, and 5.x won’t get official fixes, so take those servers offline if you can’t update them online.
If you’re short on time, you can turn off “session.upload_progress” in php.ini to buy yourself some time. This is just a temporary fix. Only updating will fully solve the problem.
Keep Your PHP Updated or You Have to Pay Later
Check your website’s security and protect it from the latest cybersecurity threats. The PHP2Shell flaw is a good reminder that the risk doesn’t stop at one website. Whether you run a personal blog or a government portal, your PHP is part of your security. Treat updates as frontline work, not something to do when you have time. Stay ahead of the next one by making updates a habit, instead of panicking in the last hour.
Frequently Asked Questions
The PHP vulnerability is a pair of security flaws in PHP. The bugs CVE-2026-109618 and CVE-2026-109619 are in PHP’s core runtime. They let attackers access the website’s internal server without signing in.
You can’t tell by looking. Run a web security check on every server, starting with the PHP version on both the web workers and the command line.
PHP2Shell vulnerability is dangerous because hackers don’t need any login to attack web servers. It sits inside PHP itself, so even a clean site can be hit.
PHP2Shell cybersecurity alert pushed websites to patch quickly or shut down. Several governments chose to switch off as a precaution.
Online PHP vulnerability scanners can help, but many only read the headers your server sends, and those headers can be hidden or wrong.
