Overview
- Security teams have confirmed two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution and are being called “PHP2Shell.”
- The PHP project published emergency fixes on Wednesday, October 21, to close the vulnerabilities and vendors and national CERTs have urged immediate installation of those updates.
- Germany’s BSI issued an Orange‑level warning and explicitly recommended that operators consider taking vulnerable webservers offline if they cannot apply patches quickly.
- Many public institutions, including state portals, universities and hospitals, temporarily took sites offline while operators race to patch, and some proof‑of‑concept material has circulated with unconfirmed reports of early exploit attempts.
- Long‑tail exposure is the main remaining risk because PHP underpins WordPress and other CMSs, distribution package delays and unsupported older versions mean patches will be applied unevenly and attackers could automate exploits within hours to days.