Overview
- On Wednesday, October 21, the PHP project released emergency updates that fix two critical remote‑code‑execution flaws given CVE‑2026‑109618 and CVE‑2026‑109619 and dubbed PHP2Shell.
- Security agencies including Germany’s BSI, the NSA and the FBI rated the risk extremely high and urged immediate installation of the patches or temporary disconnection of affected webservers.
- Because exploit details leaked before the patch and hosts reported early probes, defenders face acute time pressure as attackers could turn the disclosed fixes into automated or AI‑assisted exploits within hours.
- Many public institutions — state governments, cities, universities and hospitals across Germany and other European countries — took websites offline as a precaution while operators install and verify updates.
- PHP underpins a large share of the web (notably many WordPress and other CMS sites), so unpatched servers raise risks of site takeover, data theft and service outages and make prolonged remediation and version upgrades likely.