Emergency patches for two unauthenticated remote code execution bugs in PHP itself, with exploitation already underway.
TechCrunch reports on PHP2Shell, two critical flaws in the PHP language itself, tracked as CVE-2026-109618 and CVE-2026-109619, that let an attacker break into a PHP-based server without a password. PHP powers roughly 70% of the web-facing internet, including WordPress, Drupal, Joomla and MediaWiki, so the PHP Foundation shipped patches and gave large companies and hosting providers early, embargoed access before disclosure. The NSA urged organizations to patch immediately or take affected sites offline, and some government and company websites went down.
Amazon said it detected exploitation attempts about a week before the patches shipped, and Palo Alto Networks and Trail of Bits later confirmed compromises. Cloudflare's CEO said attempted exploits rose sharply once the flaws were disclosed.
Why it matters: a flaw this deep in the software stack underneath most of the web, not an app or a plugin, shows how widely a single unpatched dependency can reach. Confirm your PHP version and hosting stack are patched, and treat vendor-confirmed exploitation as a signal to check logs now, not later.