Overview
- Security teams disclosed on Wednesday, October 21, 2026 that two PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619 and labeled “PHP2Shell,” let attackers run arbitrary code on affected servers.
- The flaws are rated very high severity with a CVSS around 9.2 and can give full control of websites, let attackers steal data, or let servers be reused to launch further attacks.
- Germany’s Bundesamt für Sicherheit in der Informationstechnik raised the national threat level to Orange and warned that large-scale exploitation is likely within hours once technical details or patches circulate.
- Some public bodies have taken external sites offline as a precaution — for example the city of Mainz temporarily shut its portal mainz.de — while PHP maintainers and hosting firms race to publish and distribute fixes.
- At publication there were no confirmed mass compromises but unconfirmed exploit reports exist, so operators are urged to contact administrators or hosts, apply official PHP updates at once, or offline nonessential public services until patched.