PHP2Shell: Governments on high alert after critical PHP website flaw discovered

Governments and organisations across the globe have taken thousands of websites offline after security researchers revealed two critical flaws in PHP, the foundational programming language that powers roughly 70 per cent of the web.

Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities carry a severity rating of 9.2 out of 10. Dubbed "PHP2Shell", they allow attackers to bypass authentication entirely and execute administrative commands on remote servers without needing a password.

The PHP Foundation released security updates on 21 October, but automated hacking tools began probing vulnerable servers within minutes of the details leaking online.

How the flaw works and who is affected

The issue stems from a memory handling error in PHP that has existed unnoticed for over a decade. By sending two specially crafted network requests, an attacker can crash the server's memory allocation and trick PHP into executing arbitrary code.

Because PHP underlies popular content management systems like WordPress, Drupal, and Joomla, virtually any web application running on unpatched PHP versions is exposed. Cyber security firms Calif and Wiz independently identified the flaws in August using artificial intelligence tools, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon.

While major platforms rushed out defences, national agencies and private entities pulled portals down to prevent breaches.

Attack traffic spikes within hours

According to Cloudflare, automated exploitation attempts escalated rapidly immediately following the public disclosure on 21 October.

Amazon Threat Intelligence reported detecting exploitation attempts in its systems as early as 17 October, five days before the planned disclosure date, indicating that details had begun leaking beforehand. Japanese Prime Minister Sanae Takaichi issued a public request on social media urging system administrators to apply patches immediately.

What website owners need to do

Cybersecurity agencies in the UK and US have advised all administrators to immediately update their systems to supported versions or disconnect vulnerable servers from the internet.

For general web users, security experts advise monitoring accounts for unusual activity, though individual devices like phones and laptops are not directly exposed to the server-side bug.