Two long-overlooked vulnerabilities in PHP, dubbed PHP2Shell, forced many organizations to scramble for patches this week. Researchers warn the situation is not yet over.
Two vulnerabilities in PHP, the decades-old open-source web language, were recently found to be exploitable after sitting unpatched since they were first discovered in 2024. Tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, the flaws could let an attacker reach a PHP-based website or internet-facing server remotely and without a password, potentially gaining full control and planting malware.
The PHP Foundation released fixes on Wednesday, after giving major internet companies and web hosts an early chance to patch under a confidential embargo. Many organizations, including banks, retailers, hospitals and some government agencies, took systems offline to apply updates. Researchers at Calif, who found the bugs during a security audit, said AI helped with exploitation but that their existing expertise did most of the work.
Amazon reported detecting exploitation about a week before the patches came out, and the PHP Foundation blamed one company for releasing patches hours before the embargo ended. Cloudflare’s CEO said his company had seen a sharp rise in exploitation attempts after disclosure. Security experts warn that many systems remain unpatched, and smaller IT teams and legacy systems may be slow to update.
The episode highlights wider risks from aging, memory-unsafe software that underpins much of the web. Some experts expect AI tools to uncover more flaws in such technology in the future.
Source: TechCrunch
