PHP bugs triggered a global rush to patch websites

The PHP2Shell flaws pushed companies and governments to patch fast or take services offline, while reports of real-world exploitation raised the stakes.

On Wednesday, two long-hidden vulnerabilities in PHP briefly pushed parts of the internet into emergency mode. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, can let an attacker break into systems running PHP without a password.

The concern was immediate because PHP still underpins a large share of the web. As patches were released, companies, governments, banks, retailers, hospitals and other organizations rushed to update their systems or take services offline to reduce the risk of intrusion and data theft. According to IT-PUB News, the response quickly spread well beyond software teams because so many everyday services rely on PHP-based systems.

PHP's long-known flaws suddenly became urgent

PHP is an open-source language used to build websites and web apps, both on public servers and on internal company systems. The two bugs had been known since 2024, but at the time they were not considered exploitable and were left unpatched.

That changed when researchers found a way to turn them into working attacks. Calif, the security research team credited with the discovery, alerted the PHP Foundation, which coordinated the disclosure process and prepared fixes under embargo.

The foundation released patches on Wednesday and had already given some of the largest internet companies and web hosts an early chance to prepare. That advance notice helped limit the damage, at least for now, but it also meant a large part of the industry had to move quickly once the fixes became public.

Why PHP2Shell was seen as a high-risk threat

The concern centered on the kind of access the bugs can provide. In simple terms, they can be used remotely over the internet, without the victim clicking anything or opening a file.

That makes the flaws especially dangerous because they allow unauthenticated access. An attacker who succeeds could potentially gain control of an unpatched system, plant malware, steal data, or keep a foothold for later use.

Researchers said the issue was serious not only because of what the bugs do, but because of where they sit in the internet stack. PHP is still widely used, and around 70% of the web-facing internet relies on it in some form, even if its share has slowly declined over time.

Organizations took websites and services offline to patch

The response was broad and immediate. From Wednesday, governments began urging citizens and companies with websites to take action. Many organizations temporarily shut down websites or pulled services offline while applying the fixes.

Among those affected were banks, retailers, gaming sites, online stores, hospitals and some government agencies. The shutdowns were meant to prevent attackers from exploiting the bugs before the patches were installed.

The impact reached far beyond security teams. For businesses, the choice was short-term disruption or the risk of a breach. For users, it meant temporary outages on services they rely on for shopping, banking, health care and other daily tasks.

Exploitation was reported before and after disclosure

Although the patch release was carefully coordinated, the situation was not fully contained. Amazon said it detected exploitation of PHP2Shell about a week before the patches were available, suggesting that someone had figured out how to use the bugs early.

It is not clear how that happened. One possibility is that patch details became visible before the embargo ended, which can happen with open-source code because changes are public and inspectable. Another is that the vulnerabilities were discovered independently, or that information leaked during the disclosure process.

The PHP Foundation said one company pushed the patches live hours before the embargo expired, which may have given some attackers an early view of the fixes. But that does not explain the earlier activity Amazon reported.

By late Friday, security companies Palo Alto Networks and Trail of Bits had confirmed compromises and post-exploit activity tied to the PHP bug. The flaws were no longer theoretical — they were already being used against at least one target, even if the full scale of abuse was still unclear.

A large number of systems remain unpatched

Security researchers are warning that the story is far from over. A large number of systems around the world remain unpatched, and those machines are still vulnerable to hacking and data theft.

The risk is not limited to traditional websites. PHP is also used in developer tools, command-line packages and other software components that can end up inside routers, storage devices, firewalls and VPNs. That broad footprint means the patching effort can stretch well beyond website owners.

Matthew Prince, chief executive of Cloudflare, said the company had seen an exponential rise in attempts to exploit the bugs after disclosure. That does not mean all of those attempts succeeded, but it does show how quickly attackers move when a new weakness becomes public.

Smaller IT teams and solo developers may take longer to update, which could leave some systems exposed for a while. And because many companies build products on top of PHP, the work may continue even after the first wave of patches.

The incident exposed pressure on aging internet software

The PHP incident also points to a wider problem in the internet’s infrastructure. Much of the web still depends on aging but functional software built decades ago and now deeply embedded in everyday services.

Researchers said this may not be the last major scare of this kind. They pointed to the combination of legacy technology and AI tools that can help uncover weaknesses faster than before. Calif said AI was used to assist with exploitation work, but not as a replacement for human knowledge and experience.

The broader concern is that older software often lacks the protections found in newer memory-safe languages such as Python, Rust and Swift. PHP and similar technologies can still be attacked through memory-related flaws, a category that remains common in real-world intrusions.

For now, the world appears to have avoided the worst-case scenario. Even so, the episode showed how quickly a pair of dormant bugs in a foundational technology can force websites offline, disrupt businesses and expose how fragile parts of the internet still are.