Serious Security Vulnerabilities in PHP Put a Large Part of the Internet at Risk

Staff Report: PNN

Two critical vulnerabilities in PHP, a widely used web technology, have created a significant cybersecurity risk across the internet. Known collectively as “PHP2Shell,” the flaws could allow cybercriminals to access certain internet-connected servers without a password, steal information, or install malicious software. To address the threat, organizations around the world have temporarily taken websites and online services offline while implementing security updates.

According to a report by technology news outlet TechCrunch, the two vulnerabilities have been officially identified as CVE-2026-109618 and CVE-2026-109619. The PHP Foundation, which maintains the PHP technology, released security patches to address the flaws last Wednesday. However, security researchers have warned that many servers worldwide remain vulnerable because they have not yet been updated, even after the fixes became available.

PHP is an open-source programming language widely used to build websites and web-based applications. Numerous websites and online services have relied on the technology for many years. Popular platforms such as WordPress, Drupal, Joomla, and MediaWiki also use PHP. As a result, security weaknesses in PHP can pose risks to a vast number of websites and organizations rather than remaining confined to a single software product.

According to security researchers, the two flaws could potentially be exploited to execute malicious code remotely on a system. This type of attack is known as “remote code execution.” If an affected server does not have the appropriate security updates installed, an attacker could gain access, steal information, install malware, or establish a foothold for further attacks.

The report states that researchers discovered the vulnerabilities in 2024, but at the time, they did not know how to exploit them effectively. More recently, researchers developed techniques for using the flaws to conduct attacks. After the PHP Foundation was notified, a coordinated effort was undertaken to fix the vulnerabilities and give relevant organizations an opportunity to prepare in advance.

Before the security patches were released, major technology companies and web-hosting providers were confidentially informed about the vulnerabilities so they could secure their systems ahead of time. Despite these measures, the report states that some systems were attacked by exploiting the weaknesses.

Amazon said it had detected attempts to exploit the vulnerabilities approximately one week before the PHP security patches were released. According to the company's observations, relevant systems should be examined for signs of attacks dating back to October 17. However, no definitive explanation has emerged regarding how the attackers obtained information about the vulnerabilities.

The report outlines several possibilities, including an information leak before the security patches were released, shortcomings in the coordination process, or attackers independently discovering the vulnerabilities. The PHP Foundation also stated that one organization released a patch several hours before the end of the designated confidentiality period. However, it remains unclear whether that incident was directly connected to the early attacks detected by Amazon.

According to the report, cybersecurity firms Palo Alto Networks and Trail of Bits reported finding evidence of intrusions related to the PHP vulnerabilities and subsequent malicious activities late Friday. At that point, however, the full scale of the attacks and the number of affected systems remained unclear.

PHP's widespread use makes the vulnerabilities particularly concerning. The report states that PHP is associated in some way with approximately 70 percent of the web. This statistic does not mean that 70 percent of websites have definitely been compromised. Rather, the technology's extensive use significantly expands the potential scope of the risk.

PHP is not limited to web servers. It is also used in various developer tools, command-line packages, routers, storage devices, and corporate security equipment. Consequently, securing PHP-dependent software and hardware components is just as important as updating websites.

There is no guarantee that every organization will be able to implement the fixes quickly following the PHP Foundation's release of the patches. Smaller organizations operating with limited staff, independent developers, and institutions using outdated software may take longer to update their systems. Applying new security patches can also be difficult for certain legacy systems.

The incident has also prompted renewed discussion about the potential and limitations of using artificial intelligence to identify software security vulnerabilities. According to the report, researchers at a company called Calif discovered the two flaws while reviewing PHP's code. They were participating in the “Hack the Planet” initiative run by OpenAI and cloud security company Wiz. Wiz and OpenAI subsequently helped assess the effectiveness of the associated attack techniques.

Although AI assisted the researchers, the entire process did not rely exclusively on artificial intelligence. The researchers' prior knowledge of PHP's code structure, previous security vulnerabilities, and methods for exploiting them also played an important role.

The incident demonstrates that AI can accelerate security research. At the same time, as the ability to discover previously unknown software vulnerabilities increases, so does the risk that those weaknesses could be misused. However, the researchers did not support the notion that AI can identify every security flaw simply by receiving general instructions.

Matthew Prince, chief executive of Cloudflare, reported that a large number of attack attempts had been detected worldwide following the disclosure of the vulnerabilities. He said the company's network monitoring showed a rapid increase in attempted attacks after the flaws were made public.

Although there is currently no evidence of a large-scale global disruption, the security threat has not disappeared. Servers and software that have not yet been updated could become targets in subsequent attacks. Security specialists therefore consider it essential to apply the necessary patches promptly and examine affected systems for evidence of unauthorized access.

The internet's extensive dependence on old software and infrastructure could continue to create similar crises in the future. When vulnerabilities in technologies that have been used for decades are newly discovered, their impact can extend beyond individual organizations and affect online services worldwide. The PHP incident is therefore not merely a case of software vulnerabilities; it also highlights the need to regularly update and secure the critical infrastructure on which the internet depends.