Two PHP Vulnerabilities Put Web Servers at Risk

Two vulnerabilities in PHP, a widely used programming language for websites and web apps, prompted a coordinated effort to patch exposed systems. Researchers said the bugs could let attackers take control of unpatched internet-facing servers without a password.

The flaws, dubbed PHP2Shell and identified as CVE-2026-109618 and CVE-2026-109619, were discovered in 2024 but were not considered exploitable then and remained unpatched. Researchers at Calif later found a way to exploit them and alerted the PHP Foundation, which maintains the software. The foundation shared fixes confidentially with major companies and web hosts ahead of their public release on Wednesday.

The bugs enable remote code execution without requiring a victim to click a link or open a file. An attacker could use access to install malware, steal data, or maintain a foothold on an affected system. Around 70% of the web-facing internet relies on PHP, according to the source report.

The coordinated disclosure helped avert widespread exploitation so far, but researchers warned that many systems remained unpatched and vulnerable. The report says some organizations took websites and services offline while applying fixes, and governments began urging website operators to address the risks. OpenAI and Wiz’s Hack the Planet initiative was involved in the research; Wiz verified Calif’s proof-of-concept exploits. Calif said AI assisted the work, while researchers relied largely on their existing knowledge of PHP’s code and exploitation history. Amazon said it detected PHP2Shell exploitation before the patches were released.