PHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell
Original title: PHP-ocalypse: How two critical web bugs almost broke the internet
Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.
Researchers at Calif found two long-dormant PHP flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on internet-facing PHP systems. The bugs were noted in 2024 and only recently shown to be exploitable. The PHP Foundation shipped patches Wednesday after an embargo that let large hosts patch early. Researchers say many systems remain unpatched, while the article says mass exploitation was broadly avoided.
Unconfirmed: The article cuts off before substantiating a heading that the bugs were exploited before disclosure.
- OpenAI and Wiz verified Calif's proof-of-concept exploits during a code audit.
- The article says about 70% of the web-facing internet relies on PHP.
- WordPress, Drupal, Joomla, and MediaWiki are named as popular PHP-based software.
- Banks, retailers, hospitals, and some agencies took servers offline to patch.
- Calif says AI assisted exploitation work but most of the effort was manual.
Impact: Unauthenticated remote code execution on PHP servers
| Product | Affected |
|---|---|
| PHP Foundation PHP | — |
- 1.Install the PHP Foundation patches released Wednesday.
- 2.Treat remaining internet-facing PHP systems as exposed until patched.
- Vendors
- PHP Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
8 min read at techcrunch.com
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.
By Zack Whittaker · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.