PHP Critical Bugs Threaten Internet Stability
Two critical vulnerabilities in the decades-old PHP programming language threatened to upend global web infrastructure before patches were released.
Radwan AbdulhadiEditor and technology writer
The Threat of PHP2Shell
A decades-old open-source web technology almost broke the internet due to two critical vulnerabilities that sat dormant for years until researchers figured out a way to exploit them. The flaws, designated as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, allow bad actors to break into online systems running PHP without requiring a password to access or modify data.
The situation forced millions of individuals and organizations around the world to scramble and patch their systems before malicious hackers could exploit the flaws. The PHP Foundation publicly released official security patches to address the issue, providing early heads-ups to major internet companies and web hosts.
Discovery and Background
Security researchers at Calif initially found the two bugs in PHP, a programming language widely utilized globally for building websites and web applications. PHP is open-source and free, making it one of the most popular web programming languages on the internet today. Around 70% of the web-facing internet relies on PHP, although its usage has been slowly declining over the years.
The two bugs were first discovered in 2024 during a security audit but were not considered exploitable at the time and went unpatched. Researchers later found a way to exploit them and alerted the software maintainers to initiate fixes.
Severity of Remote Code Execution
PHP2Shell is considered exceptionally serious because it can be abused remotely over the internet without requiring the victim to click a link or open a file. This capability, known as remote code execution, grants attackers full control over affected and unpatched systems.
Furthermore, these specific bugs enable unauthenticated access, allowing attackers to break into any unpatched system without credentials. This vulnerability permits malicious actors to plant malware, steal data, or establish a long-term foothold on compromised servers.
Industry Response and Exploitation Prior to Disclosure
Ahead of the public disclosure, Amazon threat intelligence identified exploitation of PHP2Shell about a week before official patches became available. Amazon noted that defenders should look for evidence of exploitation activity as early as October 17.
The PHP Foundation subsequently blamed one company for pushing patches live prematurely before the embargo period officially ended. This premature release may have alerted bad actors to targeting details and exploitation methods.
Mitigation and Future Risks
Governments and industry leaders urged organizations worldwide to take immediate action and apply patches. Numerous institutions, including banks, retailers, gaming platforms, hospitals, and government agencies, temporarily took services offline to secure their environments.
Despite coordinated disclosure efforts, security researchers warn that many systems across the globe remain unpatched. Experts also caution that this incident is unlikely to be the final major software scare involving foundational internet technologies.
Sources
- TechCrunchPHP-ocalypse: How two critical web bugs almost broke the internet
Continue chronologically
Related entity coverage
Related stories
Hackers Had Four-Day Head Start on Epic PHP2Shell Flaw
Amazon reveals hackers probed the critical PHP2Shell security vulnerability four days before public disclosure, triggering a global patch rush.
How AI Tools Helped Uncover Years-Old PHP Vulnerabilities
Security researchers used frontier artificial intelligence tools to expose long-standing flaws in the PHP scripting language, triggering rapid attacks.
OpenAI Says ChatGPT Sol Helped Uncover Critical PHP Flaws
OpenAI announced that researchers using GPT-5.6 Sol uncovered critical PHP vulnerabilities, turning a two-year-old bug into working exploits.
Will AI expose the rickety infrastructure of the internet?
An analysis of recent critical PHP vulnerabilities and how the rise of artificial intelligence may expose foundational weaknesses in web infrastructure.
