Critical PHP Flaws Spark Global Alerts and Emergency Patches

Cybersecurity agencies across the globe issued urgent warnings and advisories following the disclosure of two critical vulnerabilities affecting PHP, the programming language that powers a vast majority of the world's websites. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively designated as PHP2Shell, the flaws carry a severity rating of 9.2 out of 10 and allow remote unauthenticated attackers to take full control of affected web servers.

The security issues were originally discovered two months ago by the AI security firm Calif using frontier artificial intelligence models. OpenAI, whose model was utilized during the discovery process, characterized the vulnerabilities as one of the most impactful security issues in recent memory. Calif CEO Thai Duong warned that the capability of AI to uncover deep software flaws also lowers the barrier for malicious actors to rapidly develop exploitation tools.

Details regarding the vulnerabilities leaked prematurely on the Hacker News forum prior to the scheduled coordinated disclosure. Following the leak, the PHP security team accelerated its timeline and released emergency patches for supported versions—specifically branches 8.2 through 8.5—covering updates 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Because the flaws reside within PHP itself, websites can remain heavily exposed even if their underlying custom code is completely secure.

The widespread reliance on PHP, which powers approximately 70 percent of websites whose server-side language can be identified, triggered immediate defensive reactions internationally. Government agencies in the Netherlands, Finland, and France temporarily took several official websites offline. In Japan, Prime Minister Sanae Takaichi addressed the situation publicly as childcare systems and online games were suspended as a precaution, while the Australian Signals Directorate issued its highest-level critical alert after detecting internal impacts.

Security firms monitoring the digital landscape reported that exploitation attempts began shortly after the vulnerabilities became public. Although no major organizational breaches were immediately confirmed upon patch release, decoy server networks operated by security firms recorded active scanning and probing. The Dutch national cyber agency stated that it anticipated large-scale attacks would materialize swiftly.

Organizations running outdated versions of PHP face heightened risks, as official patches are strictly limited to the four currently supported branches. Systems operating on legacy iterations, such as PHP 8.1 and earlier, lack vendor-provided fixes and require manual mitigation. Cybersecurity authorities recommended that organizations inventory all PHP deployments, apply patches immediately, or isolate internet-facing applications from public networks until remediation can be successfully completed.