PHP Vulnerabilities Explained: Why Websites Went Offline and How to Protect Yours

PHP powers most of the web, and two critical flaws forced a global patching scramble. Learn what PHP is, why the bugs matter, and how to secure your website.

What Is PHP?

PHP is a server-side scripting language that dates back to the early 1990s. It originally stood for “Personal Home Page” and now underpins huge parts of the public-facing web, including WordPress, Drupal, Joomla and Magento sites. Roughly 70% of websites in the world use PHP to power their platforms.

That reach is why a serious PHP flaw is never a niche problem. A single bug can touch millions of sites at once.

Why Did PHP Spark a Global Cyber-Security Scramble?

This week, PHP’s maintainers released an urgent notice about two new bugs, CVE-2026-109618 and CVE-2026-109619. Both are rated critical at 9.2 out of 10 and can allow remote code execution on unpatched websites. Remote code execution means an attacker can run their own commands on your server.

The response was swift and widespread:

• The EU, U.S., Germany, Japan, Australia, the U.K. and the Netherlands all issued warnings, and some governments took websites offline before the patch was released.
• Large organisations such as Nintendo took services offline while they addressed the bugs, which are being called “PHP2Shell”.
• The Dutch cybersecurity agency itself went offline as a precaution.
• Agencies including CISA and its counterparts in the U.K., Canada, Australia and the EU urged operators to take sites offline until their PHP versions could be updated.

An AI-Discovered Flaw

Two security firms, Calif and Wiz, independently found the vulnerabilities using advanced AI tools. Wiz said the bugs stayed hidden in the codebase for more than a decade and would have been extraordinarily complicated for a human attacker to exploit. The episode shows how AI is changing vulnerability research, for defenders and attackers alike.

How Bad Is the Risk?

The flaws involve how PHP responds to errors when processing HTTP requests. Cloudflare explained that by manipulating data in invalid memory, an attacker may be able to crash a PHP process, expose sensitive information, or run attacker-supplied code.

The scope is broad. The Drupal Association’s interim chief executive said every server running any PHP version released in the last 20 years is vulnerable. Researchers have also reported exploits in the wild, so unpatched systems are at real risk.
How to Protect Your Website From the PHP Vulnerabilities

1. Update PHP immediately

Install the patched release from the PHP maintainers, or from your operating system or hosting provider. Patching is the only true fix. Check the official PHP security announcements for the correct version for your branch.

2. Replace unsupported PHP versions

Many organisations can’t patch because they run old PHP versions that no longer receive security updates. If that’s you, upgrade to a supported release or plan a migration. Don’t postpone it.

3. Take exposed sites offline if you can’t patch yet

Government agencies recommended this as a stopgap, and for a high-risk or low-traffic site a short outage costs far less than a breach.

4. Ask your host what they’ve done

On shared or managed hosting, confirm that your provider has applied the fix. Don’t assume it has happened.

5. Update your CMS, plugins and themes

Update WordPress, Drupal, Joomla, Magento and their extensions at the same time. Remove anything abandoned or unused.

6. Add a web application firewall (WAF)

A WAF can block suspicious requests and buy time while you patch. It’s a layer of defence, not a replacement for updating.

7. Check for signs of compromise

Because exploits were reportedly circulating, review your server for:

• Unexpected files, especially unfamiliar PHP files in upload or temp folders
• New admin users or changed credentials
• Odd spikes in traffic or outbound connections
• Modified core files

If you find anything, restore from a clean backup, rotate all passwords and API keys, and investigate how the attacker got in.

8. Strengthen your basics

• Keep tested, offline backups.
• Run PHP with least-privilege permissions.
• Turn off PHP error display in production.
• Enable automatic security updates where possible.
• Subscribe to security advisories for your stack.

The Bottom Line

PHP’s reach is what made this incident so disruptive: when most of the web runs on one language, one flaw becomes everyone’s problem. The fix is simple but urgent. Patch PHP, retire unsupported versions, update your CMS and plugins, and check for signs of compromise. Waiting leaves your site open to attackers who are already scanning for easy targets.

Details are still developing, so check php.net and your national cybersecurity agency for the latest patch guidance.

Web Admin 

Share it.