Critical PHP Flaws Force Hundreds of Websites Offline as Attacks Begin

Two newly disclosed vulnerabilities in PHP, the scripting language behind a large share of the web, set off a global scramble to patch on Wednesday. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are rated critical by PHP with severity scores of 9.2 out of 10. They can allow remote code execution on unpatched websites. The issue is being called "PHP2Shell", and some estimates suggest more than 70% of websites use PHP.

Hundreds of websites went offline as administrators responded. Governments in the European Union, the U.S., Germany, Japan, Australia, the U.K. and the Netherlands issued warnings, and several took some sites offline before the patch was released. Large organisations, including Nintendo, also pulled services while they dealt with the bugs. PHP's security team noted that PHP 8.1 and older no longer receive updates from the project.

Attacks have already started. Cloudflare's CTO, Dane Knecht, said the company is seeing attacks emerge and has released stopgap mitigations for some customers. Jake Knott of watchTowr reported in-the-wild exploitation attempts using proof-of-concept tools built with AI help. He said nobody has succeeded so far, but does not expect that to last. Experts at watchTowr also noted that PHP-based content management systems and internal tools are common in enterprise networks, so affected servers often handle customer data and business logic exposed to the internet.