Overview
- Security researchers identified two critical PHP kernel flaws registered as CVE-2026-109618 and CVE-2026-109619 and the bugs were publicly named “PHP2Shell.”
- The PHP project released patched versions on Wednesday afternoon, and many hosting providers and operators have begun applying updates or isolating servers.
- Germany’s BSI gave the flaws a 9.2 severity score and urged immediate fixes or temporary disconnection, prompting states, cities, hospitals and universities to take sites offline as a precaution.
- Cloudflare and other firms reported massive automated probe and exploit activity—Cloudflare’s CEO said ‘millions’ of attempts—and researchers say AI tools helped find the bugs and sped up exploit development.
- Complete containment will be slow because many servers run unsupported PHP releases, so site operators must update or isolate systems to avoid data theft or service loss while the global patching effort continues.