🚨PHP2Shell Vulnerabilities Exploited, 70% of Web at Risk
70% of the web is running unpatched PHP, hackers rejoice
TL;DR
PHP2Shell vulnerabilities allow remote code execution without passwords. 70% of web-facing systems are at risk. Patches released, but many remain unpatched.
PHP2Shell vulnerabilities, officially designated as CVE-2026-109618 and CVE-2026-109619, were discovered in PHP, allowing remote code execution without passwords. These bugs affect 70% of web-facing systems, making them a massive security risk. The PHP Foundation released patches on Wednesday, but many systems remain unpatched, leaving them vulnerable to exploitation. Security researchers warn that the situation isn't over, with confirmed compromises and post-exploit activity already reported.
Key Points
PHP2Shell vulnerabilities allow remote code execution without passwords, affecting 70% of web-facing systems.
CVE-2026-109618 and CVE-2026-109619 were officially designated by the PHP Foundation on Wednesday.
Patches were released on Wednesday, but many systems remain unpatched, leaving them vulnerable.
Security researchers warn that confirmed compromises and post-exploit activity have already been reported.
The PHP Foundation coordinated disclosure under a tightly guarded embargo, giving big companies an early headstart.
Why It Matters
If you're running a PHP-based website, you need to patch now. 70% of the web is at risk, and confirmed compromises are already happening. The PHP Foundation's coordinated disclosure helped, but many systems remain unpatched.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,567 builders reading daily.