Two critical vulnerabilities in PHP have forced governments, enterprises and website operators to undertake emergency patching, temporarily disable online services and review internet-facing systems for possible compromise. The vulnerabilities, collectively known as PHP2Shell, have been assigned the identifiers CVE-2026-109618 and CVE-2026-109619.
Both flaws carry a CVSS v4.0 severity score of 9.2 and could allow an unauthenticated attacker to execute code through a vulnerable PHP process. Depending on the affected configuration, a successful attack could expose sensitive information, crash services or give an attacker access to files and databases associated with the web server. The weaknesses are within the PHP runtime itself, meaning that updating a website’s content-management system, application code or plugins alone is insufficient.
The PHP security team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the vulnerabilities. Administrators have been advised to install the appropriate update, restart PHP workers and examine systems that were exposed before patching. Organisations unable to apply the fixes immediately were advised to isolate vulnerable applications or temporarily remove them from public networks.
Cloudflare said it began deploying web-application firewall protections for customers before the public disclosure and subsequently observed attack traffic targeting the vulnerabilities. Government and institutional websites in several countries were taken offline as a precaution while technical teams installed the updates. The Finnish government’s website was among the services that became partially unavailable during remediation.
Artificial intelligence systems were used by researchers during the discovery process. PHP’s maintainers led the remediation, with technical assistance and coordination from security researchers and infrastructure companies. The episode demonstrates how AI-assisted vulnerability research can uncover weaknesses that have remained within widely deployed software for years, while also sharply compressing the time available for defenders to respond once technical details become public.
PHP powers a substantial share of websites using a known server-side programming language. The scale of that installed base makes prompt patching essential for enterprises, government departments, hosting providers and digital-service operators.
