Governments and cybersecurity agencies worldwide have taken emergency action after the discovery of two critical vulnerabilities in PHP, the programming language used by roughly 70% of all websites.
The PHP team issued an urgent update on Wednesday to patch the flaws, known as PHP2Shell, and advised immediate installation. Cybersecurity agencies in Europe, the United States, Australia, and Japan recommended temporarily disabling PHP-based sites until fixes were applied. Finland, the Netherlands, Germany, Belgium, and France restricted access to public websites, while the White House said U.S. federal agencies were working with AI laboratories on a solution.
Security researchers confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, had been exploited in the wild. Adel Karimi of Perplexity and Marcus Hutchins of Expel documented successful remote code execution attacks against systems running PHP 8.4.26, with evidence of memory disclosure and command execution . Amazon Threat Intelligence also detected exploitation attempts four days before patches were released.
In Italy, the National Cybersecurity Agency reported that 285,149 of 348,130 checked PHP-based sites—about 82%—remained unpatched as of 25 October . Poland preemptively took down some public bulletin board sites, with cybersecurity expert Maciej Broniarz calling the measures justified . Japan’s SoftBank suspended its mobile emergency alert system for earthquakes and tsunamis during maintenance .
The PHP team also warned of a third, unpatched vulnerability (CVE-2026-115560) that could allow remote code execution under specific configurations. Administrators were advised to disable session upload progress until a fix is released . Details of the PHP2Shell flaws leaked online before patches were available, prompting early mitigation efforts.
