A critical security flaw known as PHP2Shell has triggered global cybersecurity alerts after researchers found that vulnerabilities in PHP, a programming language used by a large share of websites, could allow attackers to execute malicious code and gain control of affected servers.
On October 21, PHP developers released emergency security updates to address two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. According to security researchers, the flaws affect PHP installations handling web requests, including versions dating back to PHP 5.4.
The vulnerabilities could allow attackers to execute code remotely, access sensitive memory and potentially obtain passwords, API keys, cryptographic certificates and database information. The risks extend to websites and services running on vulnerable servers, including those built using content management systems such as WordPress, Joomla and Drupal.
The flaws had reportedly existed for more than a decade. However, researchers at cybersecurity firm Wiz said exploiting them previously required a complex sequence of technical steps. Advances in artificial intelligence have made it easier to identify and exploit such vulnerabilities, significantly reducing the time and expertise required to develop working attacks.
The vulnerabilities were discovered in August by researchers associated with OpenAI, Wiz and another cybersecurity company. Public disclosure followed after patches became available.
The warning prompted organisations to secure their systems. Wikipedia’s operator temporarily took some systems offline for patching, while the Internet Archive was briefly taken offline to address the issue. The US National Security Agency’s cybersecurity account and the UK’s National Cyber Security Centre advised organisations to consider taking vulnerable systems offline if immediate updates were not possible.
India’s Computer Emergency Response Team (CERT-In) classified the vulnerabilities as critical and warned of potential remote code execution and system compromise. PHP developers have said updating to fixed versions is the only safe solution.
Website owners and administrators have been urged to install the latest security updates, restart affected services and review server logs for signs of intrusion. Ordinary internet users are not directly targeted, but websites running unpatched PHP systems could expose their information.
Source: The Telegraph
