Two newly discovered flaws in PHP, the coding language that runs much of the internet, forced websites around the world offline this week after hackers began testing ways to break in before a fix was even ready.
Story Snapshot
- PHP’s security team rated two new bugs 9.2 out of 10 for severity, its highest danger level.
- The flaws, nicknamed “PHP2Shell,” let attackers run code on a server without even needing a password.
- Details leaked online before PHP could release its fix, forcing an emergency patch release.
- Some websites, including event-planning service RSVPify, took themselves offline as a precaution.
- Security researchers say scans found millions of servers still exposed to the risk.
What The PHP Bugs Actually Do
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, let an attacker run commands on a web server without logging in first. That kind of flaw, called unauthenticated remote code execution, ranks among the most dangerous types of bugs in cybersecurity because it gives outsiders a direct path into a system. PHP powers a huge share of the websites people use every day, including many built on popular platforms like WordPress.
The PHP Foundation’s security team gave both flaws a CVSS v4.0 score of 9.2, placing them in the “critical” category, the highest tier the scoring system offers. Researchers at the security firms Calif, Wiz, and OpenAI discovered the bugs and reported them to PHP’s maintainers, who began preparing a coordinated fix.
A Leak Forced An Early Release
PHP originally planned to quietly test and release its fix on a set schedule. That plan fell apart after details about the vulnerabilities leaked online, pushing the project to announce an emergency, unscheduled release. The fix shipped Wednesday, October 21, at 14:00 UTC, built into updated versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The European Union’s cybersecurity response team, CERT-EU, issued its own advisory the day before the patch dropped, warning organizations across Europe to prepare. Cloudflare, which routes traffic for a huge portion of the internet, reported seeing early attempts by hackers to exploit the bugs even before most server owners had a chance to update. The company rolled out emergency filtering rules as a temporary shield for sites it protects.
Scope Of Exposure Still Being Measured
Internet scanning firm Censys reported finding roughly 2.58 million servers still showing signs of exposure to the flaws after the patch became available, underscoring how slowly some organizations update their systems. Security agencies urged anyone who could not immediately install the patch to cut internet access to affected servers entirely rather than leave them exposed.
A severity score like 9.2 measures how bad a flaw could be if exploited, not how many hackers are actually using it right now. The U.S. Cybersecurity and Infrastructure Security Agency keeps a separate public list, called the Known Exploited Vulnerabilities catalog, specifically to track which flaws are confirmed under real-world attack rather than just theoretically dangerous. That distinction matters: a high score demands urgent attention, but it does not by itself prove hackers have broken into any specific website.
🚨 Rapid Response: Two critical PHP RCE flaws (CVE-2026-109618/109619), both CVSS 9.2.
Censys observes ~2.58M exposed hosts and ~54.9M web properties running PHP. Exposure does not confirm vulnerability.
Patch immediately! Full advisory and Censys queries:… pic.twitter.com/e7l1ZioaKp
— Censys (@censysio) October 21, 2026
Why Everyday Websites Went Dark
Several site operators chose to shut down temporarily rather than risk a break-in while they scrambled to update their systems. RSVPify, an event-planning platform, told customers it was taking itself offline as a precaution while it responded to the vulnerability. Hosting providers and large infrastructure companies also raced to patch their systems, with some customers publicly criticizing slower responses from certain web hosts during the scramble.
For ordinary internet users, the episode is a reminder of how much of daily life runs on software maintained by small teams of volunteers and engineers working behind the scenes. A single coding flaw, once exposed, can ripple outward fast enough to knock familiar websites offline within hours, long before most people even hear the vulnerability’s name.
Sources:
insiderpaper.com, cert.europa.eu, ubuntu.com, itpro.com, cyberscoop.com, php.net, thehackernews.com
© standardnewsdaily.com 2026. All rights reserved.
