PHP vulnerability: PHP security issues today explained

On Wednesday, the creators of PHP released urgent security updates to address two critical vulnerabilities that had previously been exposed online. The UK’s National Cyber Security Centre (NCSC) strongly advised organizations to install these patches immediately. PHP is a programming language that operates on web servers, often running in the background to retrieve data from databases and construct webpages before they reach the user's browser. It powers numerous websites, online stores, and custom web services.

The NCSC identified two flaws, identified as CVE-2026-109618 and CVE-2026-109619, which could potentially enable an attacker to execute commands on a PHP-based server without authentication. This type of security breach is known as remote code execution, one of the most severe types of software vulnerabilities. The bugs could also allow an attacker to overload the PHP server's memory, corrupt it, and potentially gain control of the server under certain conditions.

One of the vulnerabilities pertains to how PHP processes form submissions and file uploads. Both flaws were rated 9.2 out of 10 on the CVSS severity scale, a standard used by the industry to measure the severity of security issues. Security company Watchtower described them as ideal 10s, and an anonymous post on Hacker News echoed this assessment, although that post has since been removed.

Researchers have dubbed these bugs PHP2SHELL. The fixes were originally scheduled for a coordinated release later in the week, but due to information about the flaws leaking early, PHP rushed the update. The fixes are available for PHP versions 5 through 8. Up until Wednesday, there was no evidence of any attacker exploiting these vulnerabilities. However, Cloudflare CTO Dane Knecht mentioned on X that the company was observing early attacks.

Several major platforms, including Wikipedia, were affected. The Wikimedia Foundation, which runs Wikipedia, confirmed that the site experienced downtime on Wednesday, attributing it to the PHP vulnerabilities. They are actively working on resolving the issue, acknowledging that all known versions of PHP are affected, not just their own. As a precaution, the foundation temporarily took several of its systems offline while they patched everything.

If you're simply browsing the internet, no action is required on your part—the fix is the responsibility of the website owners. If you run a website, blog, or online store, verify whether PHP is involved, and confirm it's updated. If you're using a hosting service, reach out to them to ensure they've applied the necessary patch.

For businesses and organizations, the NCSC recommends identifying all systems that use PHP, particularly those accessible from the internet, and closely monitoring for updates from software vendors. If an update cannot be implemented promptly, isolate the affected system to prevent potential breaches. Cloudflare has deployed emergency firewall rules to block suspicious traffic associated with the vulnerabilities, which are accessible to all of their customers, including those on free plans.