Two serious security flaws in PHP could put millions of websites at risk, with security experts warning that attackers may begin launching widespread attacks within minutes of fixes becoming available. Website administrators are being urged to prepare for the updates immediately, as the vulnerabilities could allow attackers to run malicious code on affected web servers.
PHP maintainers plan to release fixes for both flaws, each rated 9.2 out of 10 for severity. Administrators should be ready to install the updates as soon as they are released.
Why the Flaws Are Highly Dangerous
PHP is a widely used programming language that helps websites and web applications work. It powers WordPress and many other website-building platforms, as well as internal tools used by businesses.
One security researcher estimated that around 1.3 million internet-connected systems could be affected.
If attackers exploit the flaws, vulnerable systems could face serious security problems. The reported severity and widespread use of PHP make the vulnerabilities a concern for website operators across the internet.
Administrators should monitor official announcements and install the security updates as soon as they become available.
Attackers Could Strike Within Minutes
Security firm Sansec expects large-scale attacks to begin within 15 minutes of the patches becoming available. Other security companies, including Wordfence and Huntress, have also urged website administrators to prepare now.
Administrators should identify who is responsible for updating PHP, check which websites and applications use it, and prepare a maintenance window starting at 14:00 UTC. They should also be ready to install the fixes earlier if necessary.
Security experts recommend backing up website and database files and monitoring PHP.net for announcements. Some have even suggested temporarily taking nonessential systems offline until they can be updated.
Leaked Demo Raises Alarm
The warning follows reports that unconfirmed details about the vulnerabilities were leaked online. The leaked material reportedly included a video demonstrating an exploit tool called PHP2Shell, which can run code on web servers.
The demonstration allegedly showed the tool working against several popular platforms, including WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9.
All these platforms use PHP. However, the original leaked report could not be located, and its claims have not been officially confirmed.
Security company watchTowr said the report claimed that every PHP version from PHP 5, released in 2004, onward could be affected. The company also said it had confirmed that both vulnerabilities are real. They are tracked as CVE-2026-109618 and CVE-2026-109619.
PHP maintainers said the patches could be released earlier than planned if details of the flaws become public or attackers start exploiting them.
The post Millions of Websites Could Be at Hacking Risk From Dangerous PHP Flaws appeared first on ProPakistani.