Overview
- Security teams identified two critical PHP core vulnerabilities called PHP2Shell (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution and full takeover of affected web servers.
- The German cybersecurity agency BSI issued an unusually high '3 / Orange' warning and advised operators to consider disconnecting vulnerable servers if they cannot apply fixes promptly.
- Several German states, cities, universities, hospitals and police sites took public web services offline as a precaution after the disclosure and official warning.
- PHP developers published patched versions Wednesday afternoon and many operators have restored services, but widespread scanning and exploit attempts were observed both before and after the fixes.
- Because PHP underpins hundreds of millions of sites and many hosts run unsupported versions, experts say full remediation will take weeks to months and urge immediate updates, close monitoring for indicators of compromise, and isolation of unpatchable systems.