Must read: BT BIG STORY: What happens when the keys to internet security are no longer secret
What is PHP?
PHP, also known as Hypertext Preprocessor, is a programming language that was introduced in the mid-1990’s. The technology powers the behind-the-scenes engine of websites. When you log in, search, or check out, PHP code on the site's server often does the work. Reportedly, over 70% of websites whose language can be detected use PHP, including WordPress, Drupal, Joomla, and Magento. Wikipedia's software, MediaWiki, is also written in PHP.
What is the PHP2Shell flaw?
The flaw in PHP is called “PHP2Shell” and is tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 for severity. According to Wiz, these flaws can let attackers run their own code on a web server without logging in, or read leftover data in the server's memory, such as passwords and access keys.
Fortune reported that nearly every version back to PHP 5.4 is affected, and Palo Alto Networks identified over 22.6 million potentially vulnerable instances. Another side of the concern is how rapidly AI-powered security tools are advancing before safeguards are in place. It was highlighted that AI models helped researchers report the vulnerabilities in the PHP ecosystem. Now, these tools could potentially give malicious actors the means to discover and exploit vulnerabilities faster.
Must read: eMudhra, PHP security scare: Govt to hold high-level review, audit to assess potential damage
After the vulnerabilities were reported, Cloudflare's chief technology officer, Dane Knecht, said the company was seeing “early attacks emerging”, and Amazon Web Services said the flaw was being broadly exploited in the wild. What’s even more concerning was that there was no patch, leading operators to switch sites off. The US National Security Agency advised taking a system offline if it could not be updated immediately.
Major websites and government organisations impacted
The PHP vulnerability had repercussions across multiple regions, forcing several websites and online services offline.
In the Netherlands, government websites Overheid.nl, MijnOverheid and DigiD were affected, along with the Port of Rotterdam, hospital websites, political party sites, the lower house of parliament and the National Cyber Security Centre’s public-facing websites.
In France, the Interior Ministry confirmed that local government administrative websites had been taken offline as experts work on fixes. Meanwhile, Finland’s state IT provider, Valtori, temporarily took public government network services offline.
The disruption also extended to businesses and non-profit organisations. US-based HR software firm BambooHR warned of potential payroll disruptions affecting customers in the US, Canada and Ireland. The Internet Archive also experienced a temporary outage, Fortune reported, while the Wikimedia Foundation took several systems offline as a precaution.