FOSSWire
Search/
FOSS Applications

Critical PHP2Shell vulnerabilities expose 69% of websites to unauthenticated RCE

Brief written by the FOSSWire AI editor from The Verge How we write

1 min read 3 reads

Key Takeaway

Two twenty-year-old PHP bugs, now exploitable with AI assistance, enable unauthenticated remote code execution on servers running the language that powers nearly 70% of websites.

Summary

Two critical vulnerabilities in PHP, dubbed PHP2Shell, have prompted major sites including Wikipedia, 4chan, and DeviantArt to take services offline. Dutch and Finnish government agencies also shut down sites as a precaution. The NSA and UK NCSC recommended taking systems offline if patching is not immediately possible. The bugs, present in PHP for roughly 20 years, were discovered using AI tools by OpenAI's Calif group and Google's Wiz. They allow unauthenticated remote code execution on any PHP server.

The two CVEs and what they enable

  • CVE-2026-109618 (RCE via OOM corruption): Out-of-memory handling can interrupt PHP while internal request data is only partially initialized; request cleanup then treats invalid data as valid
  • CVE-2026-109619 (RCE via stale global state): Request-owned internal state survives after its backing memory is freed; a later request on the same worker may use that stale state before normal initialization resets it
  • Both allow unauthenticated remote code execution without administrator credentials
  • PHP Group states any site running PHP is at risk; Cloudflare CTO reported early attacks emerging
  • PHP 8.1 and older are unsupported and will not receive official fixes

Why it matters

The vulnerabilities affect the server-side language behind an estimated 69.3% of known websites. Wiz described the bugs as "among the most severe vulnerabilities discovered in software history," and the PHP Group confirmed that attackers could gain full server control, access passwords, API keys, certificates, and databases, then use compromised servers to attack others.

What to do

  • If you run a website using PHP, update to the fixed release as soon as possible; GoDaddy says any site using PHP should assume it is affected.
  • If your site runs PHP 8.1 or older, upgrade to a newer supported version because those older versions will not receive an official fix.
  • If you use a managed hosting service like Hostinger, GoDaddy, or Bluehost, check with your provider for when the fix will be deployed.
  • If you have sensitive data or sell products/services, consider disabling your site until your host patches their PHP version.

Original reference: www.theverge.com →