Two Critical PHP Bugs Nearly Broke the Internet, With Many Systems Still Unpatched

The bugs are dubbed PHP2Shell and officially designated CVE-2026-109618 and CVE-2026-109619. In simple terms, the bugs allow anyone who knows how to exploit them to break into an online system running PHP, such as a website or internet-facing server, without needing a password to access or modify its data. The situation forced millions of people around the world to scramble to patch their systems before malicious hackers could abuse them.

The PHP Foundation, which maintains the PHP web software, publicly released patches on Wednesday that fixed the bugs and prevent web-facing servers from being attacked when installed. The foundation had already given some of the biggest internet companies and web hosts that rely on PHP an early headstart on patching. Thanks to weeks of backroom chatter and careful coordination across the industry, the world has so far broadly avoided mass internet exploitation. From Wednesday, governments began urging citizens and companies with websites to take action to mitigate the risks on their ends. A wide range of industries shuttered their websites and pulled services offline to patch their systems. Banks, retailers, gaming sites, online stores, hospitals, and some government agencies took down their servers to prevent attacks.

Security researchers are warning that the situation is not over yet, and that a large number of systems around the world remain unpatched and vulnerable to hacks and data theft. This is also unlikely to be the last major internet software scare, with some expecting the advent of AI to rapidly uncover as-yet-undiscovered vulnerabilities that are waiting to be found and abused.

Security researchers at Calif found two bugs in PHP, a programming language widely used around the world for building websites and web apps, both on the internet and hosted locally on company networks, like intranets and internal sites. PHP is open-source, meaning it is free and available to be used by anyone for almost any reason. As such, it has become one of the most popular and broadly used web programming languages on the web today. The two bugs were first discovered in 2024 but were not considered exploitable at the time, and were not patched. Security researchers recently found a way to exploit them, prompting them to alert the makers of the software to get them fixed. Calif alerted the PHP Foundation, which began a period of fixing the bugs and coordinated disclosure. The foundation did this by offering the information and patches about the security issues under a tightly guarded embargo, essentially held confidentially until a specific deadline, to give big companies an opportunity to get ahead of installing the fixes.

PHP2Shell is serious because it can be abused remotely over the internet and without the victim having to click on a link or open a file. This is known as remote code execution, and it is one of the more damaging kinds of bugs to exploit because they can grant a hacker anywhere in the world effectively full control over an affected and unpatched system. Worse, these specific PHP bugs make it possible to break into any unpatched system on the internet without needing a password or any other credential over the internet, known as unauthenticated access. This would allow a malicious hacker to then plant malware on the computer, such as to steal data or simply to maintain a long-term foothold that they can return to later.

The bugs are particularly risky because PHP is wildly popular software, in part because it is free and relatively easy to use, but also because it has been around for decades. Around 70% of the web-facing internet relies on PHP, though its usage has been slowly declining over the years in favor of newer, more secure programming languages. Given its popularity, some of the world's most popular websites are run on web software that relies on PHP, such as WordPress, as well as Drupal, Joomla, and MediaWiki, which powers online encyclopedia giant Wikipedia. PHP is just one of many aging but functional technologies that have survived waves of the internet and generations that are now so ubiquitous, they are akin to the glue that holds much of the internet together. Oftentimes these tools are developed by open source maintainers, who are not paid for the work that they do, and as such cannot afford third-party security reviews, but are still widely relied on by companies who do not contribute financially to the projects. Calif was credited with discovering the bugs earlier this year as part of a security audit of PHP's code.