Hundreds of websites taken offline as concern grows over two PHP vulnerabilities
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
Excerpt from the primary source: The Record by Recorded Future News
Who is affected
Security professionals
What you should do · Patch
Apply the vendor's security update for the affected products. Check the linked advisory for affected and fixed versions, and put internet-facing systems first.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
Two critical RCEs in PHP core
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial…
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities…
Attackers are exploiting this at scale, so exposed affected systems are likely to be targeted quickly.
Treat this as an emergency.
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
There's only so much code: the rise in vulnerability numbers
The September Microsoft Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?