PHP2Shell: two flaws in PHP put a large part of the web under pressure
The PHP Foundation released patches on 21 October, but attackers were active earlier. Anyone running PHP needs to update now.
Two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), let attackers run code on a server over the internet, without a password and without anyone having to click anything, TechCrunch writes. PHP powers WordPress, Drupal, Joomla and MediaWiki, among others, and is also found in routers, firewalls and VPN devices.
The PHP Foundation published the patches on Wednesday 21 October. According to TechCrunch, Amazon saw exploitation about a week earlier, and Cloudflare reported an explosion of attack attempts after disclosure. Researchers at the company Calif found the flaws; AI helped work out the attacks, but most of the work relied on their knowledge of the PHP code.
De Tijd sees the panic as a sign that the internet's governance structures have not adapted to fast, AI-assisted attackers. Security firms such as Cloudflare and Akamai look like the winners on the stock market, but are already richly valued, the paper writes.