PHP-ocalypse: How two critical web bugs almost broke the internet
Researchers uncovered a way to exploit two long-dormant PHP vulnerabilities, creating a risk that attackers could take control of exposed websites and servers without a password. The PHP Foundation released patches on Wednesday after coordinating with major internet companies and web hosts, helping avert widespread attacks so far.
The flaws, named PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, were discovered in 2024 but were not then considered exploitable. Their remote-code-execution potential prompted organisations including banks, retailers, hospitals and government agencies to take services offline while patching. Researchers warn that many systems remain vulnerable, leaving risks of hacking and data theft.
In short
- Two PHP flaws could let attackers take control of unpatched systems.
- Coordinated patching helped prevent widespread exploitation so far.
- Researchers say many vulnerable systems remain online.