The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10 and affect all PHP installations serving web requests Governments and companies in several countries temporarily took websites offline this week over two critical vulnerabilities in PHP, the programming language that powers much of the internet, which allow an attacker to run code remotely on servers without authenticating. PHP’s development team released fixes on Wednesday and urged users to update immediately.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10 and affect all PHP installations serving web requests, including platforms such as WordPress, Drupal and Joomla. The US Cybersecurity and Infrastructure Security Agency (CISA) has dubbed them “php2shell”. The fixes are available in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The European Union’s computer emergency response team advised organisations unable to patch immediately to isolate exposed applications from the internet. According to its latest advisory, proofs of concept are already circulating publicly, raising the likelihood that the flaws are being exploited. Security firms report attack attempts, so far without confirmed success. The US National Security Agency (NSA) urged organisations to prepare to update, and CISA and the UK’s National Cyber Security Centre called for patches to be applied as soon as possible.
As a precaution, the Netherlands took offline portals including the DigiD digital identity system and parliamentary websites; Finland, several public services; and France, its prefecture websites, according to the specialist press. Sites were also taken down in Denmark and Australia, and on major platforms in Japan, whose Prime Minister Sanae Takaichi urged checks on public websites using PHP and preparation to apply the fix.