PHP maintainers have warned of two critical vulnerabilities – each rated 9.2 out of 10 for CVE severity – and said a fix is on the way. They urged all PHP users to prepare in advance, as the flaws are considered severe enough to be immediately exploited in the wild, and advanced releases may be warranted should that happens.
PHP Vulnerabilities Raise Concern Across The Web
PHP is a programming language that runs a large share of the web, including WordPress, Drupal, Joomla and Magento sites, shared hosting platforms and many internal tools. One researcher estimated that about 1.3 million internet-connected hosts could be affected. Both flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both allows for remote code execution (RCE) attacks – meaning hackers can take over a server without any control required from the website admins.
The advisory followed a leaked report, which showed a tool called PHP2Shell running code on servers using aforementioned website software; it also claims that every PHP version from PHP 5 (released in 2004) onward is affected. Security firm Sansec expects mass attacks to begin “within 15 minutes of the release,” while Cloudflare CTO Dane Knecht said early attacks are already appearing and that the company is updating its firewall rules as a stopgap, urging site owners to patch their servers as soon as possible once the update is out.
If you are someone responsible for a website, be prepared: identify who manages PHP in the organization, list every app built on it and back up the website and database files. Admins should also plan a maintenance window starting at 14:00 UTC (10PM Malaysian time), with a contingency to move earlier, and watch the maintainers’ homepage for announcements (as of this writing, emergency patches for PHP 8 is now online). Some experts suggest disconnecting nonessential systems until they are patched.
Government agencies – amongst the most likely of targets once the flaw is exposed in the wild – in the Netherlands and Finland took websites offline today as a precaution, and the Dutch cybersecurity agency also went offline. Cybersecurity agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately, or to take websites offline outright until patches can be applied. You may see some website inaccessible for the time being, so bear with IT admins out there while they scramble to contain the chaos.
Sources: Ars Technica | Reuters
Pokdepinion: Almost reminiscent of the Y2K bug with the sheer scale of this one.
