A major global cybersecurity crisis has erupted after security researchers uncovered “PHP2Shell”, a pair of critical zero-day vulnerabilities affecting PHP, the core server-side scripting language that powers nearly 70 per cent of all websites worldwide.
The sudden and uncoordinated online disclosure of the vulnerabilities has triggered aggressive, automated mass-scanning campaigns by hostile threat actors. In response, national cybersecurity agencies, major telecommunications providers including Orange, local municipal councils, and National Health Service (NHS) trusts across Europe have severed public access to dozens of digital services to pre-empt compromise.
The flaws – catalogued under CVSS v4.0 severity ratings of 9.2 – had remained hidden in PHP’s underlying code architecture for more than a decade. They were surfaced through joint security research conducted by cloud security firm Wiz Research and automated code-auditing initiatives using frontier artificial intelligence systems from OpenAI.
Technically, the exploit framework combines two severe architectural defects. The first, designated CVE-2026-109618, exploits an out-of-memory corruption flaw that allows remote, unauthenticated attackers to trigger remote code execution (RCE) by transmitting specifically crafted, diminutive file payloads during PHP’s request lifecycle.
The companion vulnerability, tracked as CVE-2026-109619, is a use-after-free condition stemming from stale global state retention across worker threads. Much like the historic Heartbleed vulnerability, this flaw permits external actors to extract confidential cryptographic keys, operational database credentials, and raw user sessions directly from server memory.
Telemetry recorded by Amazon Threat Intelligence first detected stealth exploitation of the bug chains in mid-October. However, emergency response plans collapsed when complete exploit blueprints were leaked across social media, forcing the PHP Foundation to rush out emergency security updates for active release branches spanning PHP 8.2 through 8.5.
Because PHP forms the underlying infrastructure for content management platforms like WordPress, Drupal, and Wikimedia, the exposure footprint is vast. The UK government confirmed that over 30 public web portals have been taken offline, while digital defense bodies including the UK National Cyber Security Centre (NCSC) and the US National Security Agency (NSA) have advised system administrators to take unpatched legacy servers offline immediately until updates are fully applied.
