The PHP development team has issued an urgent call for administrators to update their systems following the discovery of two critical vulnerabilities known collectively as PHP2Shell. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow remote attackers to execute malicious code on web servers without needing any login credentials. The severity of the situation stems from the fact that a single unauthenticated request can trigger the attack before any actual application code even begins to run, leaving virtually every installation that serves web requests exposed.
What makes this breach particularly alarming is how these bugs were uncovered. Researchers from Wiz revealed that while these structural flaws had existed within PHP for decades, they remained hidden because exploiting them required a level of complexity nearly impossible for humans to navigate. However, frontier AI models have significantly lowered that barrier, transforming dormant glitches into viable weapons for cybercriminals. This intersection of legacy code and modern artificial intelligence has led some experts to describe this as one of the most significant software vulnerabilities in history.
The impact is widespread, affecting various configurations including PHP-FPM and LiteSpeed, though those utilizing Apache with mod_php are considered to be at the highest risk. To combat the threat, emergency updates have been released for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. While Linux distributions and long term support vendors received patches early, there is deep concern regarding embedded systems and abandoned applications that may never be updated. In response to the crisis, the UK’s National Cyber Security Centre has suggested that organizations take vulnerable systems offline entirely if they cannot be patched immediately.
For those running older or unsupported versions like PHP 7.4 or 8.0, the security team has provided minimal source backports given the extreme nature of the risk. Meanwhile, companies like Cloudflare have already stepped in by deploying firewall rules to block known exploit vectors for all customers regardless of their plan level. As forensic experts warn of a long tail of infections resulting from unmaintained apps, the message from the community remains clear: update your server environments now to avoid becoming part of what is expected to be a massive wave of security incidents.
