Key facts
- Two critical flaws in the PHP programming language, nicknamed "PHP2Shell", pose an "extremely high risk".
- The vulnerabilities could allow attackers to take control of web servers without logging in.
- Flaws are tracked as CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 for severity.
- PHP developers released fixes on October 21, 2026, for multiple versions of the language.
- Early attacks and exploitation attempts have been reported by security firms and infrastructure providers.
Hong Kong's information security watchdog issued an "extremely high risk" warning on Thursday over critical flaws in the PHP programming language, which powers a significant portion of the world's websites. The vulnerabilities, nicknamed "PHP2Shell" and tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to take control of web servers without needing to log in. Both flaws are rated 9.2 out of 10 for severity.
Cybersecurity agencies globally, including in Australia, Singapore, Japan, the Netherlands, Finland, and France, have issued urgent warnings and urged website operators to apply updates or take affected systems offline. The US National Security Agency (NSA) and FBI also advised organizations to take systems offline if immediate patching was not possible. Several high-profile websites and services, including parts of Wikipedia and government portals, were taken offline as a precaution.
PHP developers released fixes for multiple versions of the language at 14:00 UTC on October 21, 2026, after details of the vulnerabilities leaked online. Security firms Calif and Wiz discovered the flaws using AI models. While official agencies had not yet confirmed widespread exploitation, security vendors like Cloudflare and Patchstack reported signs of attacks and confirmed active exploitation incidents.