Two newly disclosed PHP flaws let attackers run code on web servers without logging in, forcing emergency patches and shutdowns across the internet.
Story Highlights
- PHP released emergency fixes for two critical remote code execution flaws.
- Both vulnerabilities carry a 9.2 critical severity score and affect many PHP versions.
- Security teams warn to patch now or remove public access until fixed.
- Cloud and hosting providers rolled out stopgaps, but updates remain the only full fix.
What Changed: Emergency Patches For Critical PHP Bugs
On October 21, the PHP project shipped emergency updates to fix two critical flaws that let a stranger on the internet run code on a server. The issues are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP security team rated both at 9.2 on the Common Vulnerability Scoring System, which is critical. The team said the special releases address only these two bugs. Admins must update to the patched versions to be safe.
Security outlets reported that the fixes are available in current PHP branches. The updates cover popular versions used by major content systems and custom apps. The key risk is that no login is needed to exploit the flaws. That means normal user protections do not apply. The Hacker News reported the patches land in specific minor releases. It also stated that patching is the only full protection for servers.
How Big Is The Risk: Unauthenticated Code Execution
Ubuntu’s security team warned that both flaws allow unauthenticated remote code execution for any PHP app. That expands the blast radius from a single product to almost any site using PHP. This includes small business pages, city portals, schools, clinics, and large retailers. IT Pro said security agencies urged teams to patch now or take systems offline if they cannot patch right away, due to the high risk.
IT Pro also noted the 9.2 score and the push by defenders for rapid fixes. That advice reflects a wider pattern in cyber defense. High severity scores show potential impact. Real risk also depends on exposure and whether attackers are trying to use the bug. In this case, reports say attackers began probing early. That makes delay costly. Agencies and vendors tell teams to update and reduce internet exposure until they can.
Why It Matters: A Web Backbone Under Strain
PHP powers a huge share of the web, from personal blogs to major commerce sites. When a core language has a critical flaw, the fallout spreads fast. Hosting firms like content delivery networks can add temporary filters, but those are stopgaps. BleepingComputer reported that the two bugs are grouped as “PHP2Shell,” discovered by researchers from multiple firms. The patches close the holes in supported versions, but only if admins deploy them now.
ALLi Websites Temporarily Offline
You may have noticed that the ALLi websites (both the member website and the Self-Publishing Advice Centre) are currently offline. This is due to a critical security vulnerability that has been identified worldwide in PHP, a programming language…
— Alliance of Independent Authors (ALLi) (@IndieAuthorALLI) October 22, 2026
Cloud providers pushed emergency rules to blunt common exploit attempts. Those steps can buy time and help smaller shops. But The Hacker News stressed that only updating the server code fully removes the risk. Temporary rules may miss new attack tricks. The longer servers stay unpatched, the more time attackers have to find them. This is why many agencies tie policy to known exploits and push fast patch cycles when stakes are high.
What To Do Now: Practical Steps For Site Owners
Admins should first identify every public site or app that uses PHP. Teams should update to the fixed PHP releases as soon as possible. If a system cannot be patched today, leaders should restrict internet access or place the site behind a trusted shield as a short-term step. IT Pro reported clear guidance to patch or take systems offline. Ubuntu’s advisory confirms the flaws allow code execution without an account, so delay invites compromise.
Bigger Picture: Securing Critical Infrastructure On A Budget
Small towns, libraries, and clinics often rely on old stacks and thin budgets. They feel squeezed by rising costs and complex rules. The federal government publishes a Known Exploited Vulnerabilities catalog to flag active threats and guide fixes. That tool helps teams pick battles and protect what matters most. It is a reminder that severity scores and proof of exploitation tell different parts of the story. Both play a role in smart defense.
Sources:
cert.europa.eu, ubuntu.com, cyberscoop.com, php.net, thehackernews.com
