Overview
- The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were publicly disclosed on Wednesday and allow remote code execution that can let attackers run arbitrary code on vulnerable servers.
- Developers and hosting providers pushed emergency patches on 21 October and many operators temporarily took websites offline to prevent compromise.
- Cloudflare recorded an escalation from thousands to millions of automated exploitation attempts within hours after disclosure, driving the rapid, widespread shutdowns.
- German federal agencies say they have no confirmed compromises of federal systems so far, but security teams warn that installing patches does not rule out earlier intrusions.
- Security experts urge concrete follow-ups—retrospective log reviews back to mid‑October, API key and password rotation, WAF updates and forensic audits—and the incident has renewed political calls in Germany to strengthen national cyber-resilience and coordinated vulnerability management.