PHP2Shell bugs force global scramble to patch 70% of web
Briefing by News4U · First published
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were patched Wednesday after researchers found ways to exploit them.
On Wednesday, the PHP Foundation released patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow remote unauthenticated code execution on unpatched systems. TechCrunch reported that the flaws, dubbed PHP2Shell, affect around 70% of web-facing servers and prompted governments to urge immediate action. [1]
Security researchers at Calif discovered the bugs earlier this year during an audit supported by OpenAI and Wiz. The PHP Foundation coordinated an embargoed disclosure to give major companies advance notice, limiting widespread exploitation so far. [1]
Sources
- PHP-ocalypse: How two critical web bugs almost broke the internet
TechCrunch · · Excerpt