Critical 'PHP2Shell' zero-day flaws force global scramble to patch millions of internet servers
Two remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619—triggered emergency maintenance windows across banks, retailers, and web hosts worldwide.
Technology news
A pair of critical remote code execution vulnerabilities in the core PHP programming language—collectively designated "PHP2Shell" under CVE-2026-109618 and CVE-2026-109619—has triggered an unprecedented global patching race among cloud infrastructure providers, enterprise IT departments, and web hosts. The flaws allow unauthenticated attackers to execute arbitrary system commands on internet-facing web servers without entering credentials or requiring user interaction.
The vulnerabilities, discovered by cybersecurity research firm Calif, trace back to dormant legacy memory-handling routines that were previously considered theoretical but were recently demonstrated to be weaponizable against modern multi-threaded web servers. Following confidential disclosures under a tightly held industry embargo, the open-source PHP Foundation released emergency patch builds, coordinating with major cloud platforms and Content Delivery Networks to deploy mitigation filters prior to public disclosure.
Despite early coordination, the public release of technical details on Wednesday prompted widespread service disruptions as financial institutions, online retailers, healthcare networks, and government portals temporarily severed server connections to apply kernel-level patches. Security monitoring organizations reported intense scanning activity from automated exploitation engines attempting to compromise unpatched environments across shared hosting providers.
Enterprise defense teams warn that because PHP powers more than 75 percent of all websites running server-side code, hundreds of thousands of legacy and unmaintained instances will remain exposed for months. Security experts advise system administrators to immediately upgrade to PHP versions 8.3.15, 8.2.27, or 8.1.32, verify Web Application Firewall ingress rules, and inspect access logs for abnormal serialized payloads.