GoKawiilPHP Foundation patches two critical flaws after coordinated global response
Researchers discovered two long-dormant vulnerabilities in PHP, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that let attackers break into password-protected servers running the widely used web language. The PHP Foundation released public patches on Wednesday after giving major internet companies and hosting providers early access, prompting banks, hospitals, retailers and government agencies worldwide to take sites offline to update their systems.
GoKawiil's interpretation of the reporting above, not reported fact.
The coordinated, weeks-long patching effort appears to have averted mass exploitation so far, but researchers caution that many systems globally remain unpatched and exposed. Because PHP underlies a large share of the web, flaws like these carry outsized risk, and some experts suggest AI tools could accelerate the discovery of similar undisclosed vulnerabilities in the future.
- Two critical PHP vulnerabilities, PHP2Shell, allowed password-free server compromise
- The PHP Foundation coordinated early patching with major firms before public release on Wednesday
- Many systems remain unpatched, and experts warn AI may speed discovery of future flaws
Source: techcrunch.com — Zack Whittaker, 2026-10-24
Published there as: “PHP-ocalypse: How two critical web bugs almost broke the internet”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.