PHP2Shell: Two Critical PHP Flaws Prompted Website Shutdowns After Fix Stalled for Months

The PHP Foundation has explained how two serious vulnerabilities, CVE-2026-109618 and CVE-2026-109619, came to cause worldwide alarm. Some people are calling them PHP2Shell. The Foundation said they first drew serious attention in August after an outside review by AI companies. The history of CVE-2026-109618 goes back to 2024, when PHP had its first external security audit in several years, but no action was taken.

The Foundation said the fix was held up by debate among engineers. Options carried risks such as breaking backward compatibility, creating new denial-of-service potential, or forcing changes to many third-party extensions. With no known path to remote code execution at the time, and a small group of core developers with the needed expertise, work on a fix stalled and restarted repeatedly over months.

On Wednesday, hundreds of websites were taken offline by companies and governments because of the flaws. Cloudflare reported seeing attempted exploitation. Some estimates suggest more than 70% of websites use PHP, and the Foundation said both bugs sit in parts of PHP that nearly every request touches. A VirusTotal analysis found 5.1 million IP addresses running PHP, including at least 758,000 on end-of-life versions. These figures show internet-facing exposure, not confirmed vulnerable systems. Emergency patches were released Wednesday morning, but they only cover versions back to PHP 8.2. Older versions no longer receive updates.