The internet isn’t safe. That’s the warning going around the world today, as two newly discovered vulnerabilities instantaneously made the majority of websites susceptible to targeted attacks. This isn’t a problem that impacts one site or service. It’s a global phenomenon, and you should be prepared for what happens next.
On October 20, the discovery was leaked online of two PHP vulnerabilities, dubbed CVE-2026-109618 and CVE-2026-109619. Together, they’re called php2shell. Although the original source is unknown, security experts at Huntress and watchTowr confirmed the leak’s authenticity.
Hackers could commandeer a PHP-powered website, steal sensitive user data, and deploy ransomware to extort money from the owners of the targeted site.
PHP, which stands for Hypertext Preprocessor, is an openly available scripting language that developers use to build websites and apps. It drives the server side of online experiences, so while you never see PHP firsthand, it is the reason you can access many different websites and use online services.
Given its open-source nature, PHP is a hugely popular tool that powers approximately 69%-79% of sites on the web. These include tech giants like Microsoft, financial services like American Express, telecom companies like Verizon, and many more.
Needless to say, a vulnerability of this scale has the power to completely take down the internet and serve users’ personal data to hackers on a platter.
Both CVE-2026-109618 and CVE-2026-109619 are remote code execution vulnerabilities, which means a hacker anywhere in the world can send malicious commands to a targeted server to gain control without needing a password or login information, essentially taking over with no security to get in the way. With that level of access, hackers could commandeer a PHP-powered website, steal sensitive user data, and deploy ransomware to extort money from the owners of the targeted site.
To be safe, the NSA Cybersecurity team issued a warning today for any sites that rely on PHP. The NSA wrote on X:
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
What you should do as a user
Now that you know these vulnerabilities exist, you might wonder how you can keep yourself and your data safe.
The good and bad news is that there’s nothing you should or can do. This issue directly involves websites and web developers. You — and the rest of us — are mere bystanders.
More good news: You can continue to log in to the same websites and access your data as you would before php2shell was discovered, assuming the web developer hasn’t taken its servers offline as a safety precaution. Just make sure you go directly to the website on your device or open the service through the official app on your phone. Do not click on any secondary links in messages or emails to access these platforms.
Now the bad news: php2shell is a server-side vulnerability, so if a hacker targets a website that contains your personal data, he can potentially steal your information without ever needing your username or password. Now, that doesn’t mean this will happen. Many website owners are taking precautions to protect user data, including limiting features and temporarily taking their servers offline. That means some websites you visit may be down until the security patch is implemented.
RELATED: The latest cybercrime turns security systems against you — and there's no good defense
Robert Wicher/Getty Images
The fix is in
According to the National Cyber Security Centre in the U.K., the vulnerabilities affect PHP version 5 and up — that covers websites built or maintained from 2004 to 2026. The only fix is a security patch that was released early on October 21. Web developers are urged to update their websites immediately to PHP version 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their sites’ current PHP iteration. Other versions of PHP are considered outdated and potentially dangerous, with no alternative work-arounds for php2shell.
As a user, there’s nothing you need to do to prepare for the PHP patch rollout. Just keep in mind that many of your favorite websites will undergo a serious system update over the next several days to several weeks. That means that some of the features on your favorite websites — or even the sites themselves — could temporarily go down, even if they weren’t previously taken offline after php2shell was found. Please be patient while the developers resolve this critical issue.
That’s it. Now it’s a waiting game until the patches are officially live.
More cyber threats in the news
The php2shell vulnerability is just one of three cybersecurity threats that have emerged in the last several days.
eMudhra, a cybersecurity company based in India, generated cryptographic keys in April 2025 with reduced security, making them easy for anyone to guess. Because eMudhra is a trusted certificate authority by Big Tech, the flaw left internet traffic vulnerable to man-in-the-middle attacks. This made it possible for bad actors to create fake trusted security certificates, impersonate real website domains, and intercept sensitive data. Google, Apple, Microsoft, and Mozilla have since blocked the certificates from their web browsers, and eMudhra’s stock price took a 20% dive following the discovery.
PingCAP, a California company that builds enterprise database software, was hacked. The attacker reportedly used stolen login credentials to access PingCAP’s systems to steal data and source code. PingCAP has since revoked access to the affected accounts and is continuing to investigate the issue to ensure that it doesn’t happen again.
Like Blaze News? Bypass the censors, sign up for our newsletters, and get stories like this direct to your inbox. Sign up here!