Hundreds of websites taken offline as concern grows over two PHP vulnerabilities

A set of vulnerabilities in one of the most popular scripting languages underpinning many websites set off alarm bells in the cybersecurity community on Tuesday evening. 

The maintainers of PHP — used to build and run web applications and the vast majority of websites — released an urgent notice warning of two new bugs.

The vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — carry severity scores of 9.2 out of 10 and are rated critical by PHP. 

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” PHP’s security team said. “PHP 8.1 and older no longer receive updates from the PHP project.”

Dozens of government agencies released urgent warnings throughout the evening and early on Wednesday morning telling website maintainers to stay alert and patch now that fixes have been released.

Dane Knecht, the CTO of Cloudflare, said the tech giant is already seeing attacks emerging, and it released stopgap mitigations to help protect some customers. At least one video released on social media showed the vulnerabilities being used to cause damage. 

Jake Knott, head of threat intelligence for watchTowr said the cybersecurity company is also observing in-the-wild exploitation of the vulnerabilities with a variety of proof-of-concept tools vibecoded with the help of AI.

“Whilst nobody has been successful to date, we don't expect that will last long,” he said. 

The European Union, Germany, Japan, Australia, the U.K., the Netherlands all released warnings locally about the vulnerabilities and several governments even took some websites offline in advance of the patch being released.

Large companies and organizations like Nintendo and others also took services offline as they addressed the bugs, which are being called “PHP2Shell.”

Some estimates show that more than 70% of all websites on the internet use PHP. Experts at watchTowr noted that enterprise networks commonly run PHP-based content management systems and internal tools, so servers running PHP often handle customer data and business logic reachable from the internet.

But experts expressed deep concern that millions of PHP-backed websites are still running ancient versions of the language that likely cannot be updated. 

Joviane Jardim, a senior security researcher at Swedish firm Detectify, said many organizations only learn about a forgotten PHP server when an attacker finds it. 

“That’s the risk with this one: the flaws became public before the fix did, so both sides are starting at the same time. Attackers aren’t waiting for a working exploit. They’re building a list of every server on the internet that says it runs PHP, sorted by version, and the moment the fix is out, they will compare the old code with the new one to find the flaw,” he said. 

With artificial intelligence, most attackers can create a working exploit in under an hour, meaning defenders can expect a wave of exploitation shortly after the patch is released. 

Jardim added that roughly half of all PHP websites are running older versions of PHP but only PHP 8.2 and newer are getting patches. 

“That’s the real exposure. Those sites haven’t been updated in years, which usually means nobody is watching them either,” he said. 

“So the question this week is this: do you know where all your PHP is running? If yes, this is an afternoon of updates. If no, the risk is in the systems you’ve forgotten: an old marketing site, a hosting control panel, a device with PHP built in. And speed matters more than ever.”