On Wednesday, a decades-old open-source web technology called PHP almost broke the internet, thanks to two vulnerabilities that had sat dormant for years until researchers recently figured out a way to exploit them. The bugs are dubbed PHP2Shell, officially designated as CVE-2026-109618 and CVE-2026-109619. In simple terms, the bugs allow anyone who knows how to exploit them to break into an online system running PHP, such as a website or internet-facing server, without needing a password to access or modify its data.
As situations go, this was a pretty sizable one, forcing millions of people around the world to scramble to patch their systems before malicious hackers could abuse them. The PHP Foundation, which maintains the PHP web software, publicly released patches on Wednesday that fixed the bugs, which when installed prevent web-facing servers from being attacked. The foundation had already given some of the biggest internet companies and web hosts that rely on PHP an early headstart on patching.
Thanks to weeks of backroom chatter and careful coordination across the industry, the world — so far — broadly avoided mass internet exploitation. From Wednesday, governments began urging citizens and companies with websites to take action to mitigate the risks on their ends. A wide range of industries shuttered their websites and pulled services offline to patch their systems.
Banks, retailers, gaming sites, online stores, hospitals, and some government agencies took down their servers to prevent attacks. But security researchers are warning that the situation isn’t over yet, and that a large number of systems around the world remain unpatched and vulnerable to hacks and data theft. This is also unlikely to be the last major internet software scare, with some expecting the advent of AI to rapidly uncover as-yet-undiscovered vulnerabilities that are waiting to be found and abused.
Security researchers at Calif found two bugs in PHP, a programming language widely used around the world for building websites and web apps, both on the internet and hosted locally on company networks, like intranets and internal sites. PHP is open-source, meaning it’s free and available to be used by anyone for almost any reason. As such, it’s become one of the most popular and broadly used web programming languages on the web today.
The two bugs were first discovered in 2024 but weren’t considered exploitable at the time, and weren’t patched. Security researchers recently found a way to exploit them, prompting them to alert the makers of the software to get them fixed. Calif alerted the PHP Foundation, which began a period of fixing the bugs and coordinated disclosure.
Extract — continue reading at the source.
