Two newly disclosed security flaws could put websites that people use every day at risk, potentially allowing hackers to take control of vulnerable servers or access sensitive information stored in their memory. The problem lies in PHP, behind-the-scenes technology used across a huge portion of the internet. That means people could potentially be affected without ever knowing what PHP is or that a website or online service they use depends on it.
Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable to these particular attacks. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.” The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been dubbed “PHP2Shell” and both carry a critical CVSS v4.0 severity rating of 9.2.
Google Cloud said PHP versions 5.4 through 8.5.11 are affected, with fixes included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The discovery is also drawing attention because artificial intelligence played an important role in the research. Google Cloud said Wiz Research used multiple AI models while identifying and helping remediate the vulnerabilities, with Gemini 4 Argon contributing to vulnerability discovery, exploit development, attack detection and patch validation.
PHP operates largely out of sight of ordinary internet users but sits underneath websites and web applications across the internet. The potential reach extends across major web platforms. Sansec reported that researchers demonstrated unauthenticated remote-code execution against applications including WordPress, Drupal, Joomla, Magento, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS.
Newsweek reached out to some of the impacted platforms by email for comment Wednesday. Thank you for reaching out to the Wikimedia Foundation, the non-profit that operates Wikipedia and other Wikimedia projects. Please find our response below, this can be attributed to a Wikimedia Foundation spokesperson.
This issue affects all known versions of PHP, and is not specific to the Wikimedia Foundation," a Wikimedia spokesperson told Newsweek on Wednesday in an emailed statement. "All Foundation-supported systems and volunteer-run systems that use PHP are affected. We have taken down a number of other systems as a precautionary measure until they can be safely patched.” In a statement posted to its website, Drupal said: "Site owners are responsible for maintaining the security of their hosting platform.
Extract — continue reading at the source.
