What is PHP2Shell, and why did it force websites around the world offline?

PHP, or Hypertext Preprocessor, is a widely-used open-source programming language powering roughly 70% of websites. It enables servers to process information submitted by users, such as login credentials, applications, and purchases. PHP is free to use and maintained by volunteers, underpinning services from major platforms like WordPress, which powers over 40% of websites globally, to critical infrastructure like Wikipedia.

Two critical vulnerabilities, collectively termed PHP2Shell, were identified in PHP. These flaws allow attackers to remotely execute malicious code on servers without authentication or access sensitive data in server memory. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, stem from memory management issues within PHP. The first can occur when PHP runs out of memory during request processing, potentially treating incomplete data as valid.

The second arises from PHP retaining references to previous request data, which could skew subsequent requests.

Cybersecurity researchers discovered these flaws, with Google's security firm Wiz attributing the discovery to AI tools and OpenAI crediting a security firm called Calif. These vulnerabilities present a significant risk, as they could allow attackers to compromise servers and access sensitive data without direct access to the server.

The flaws could be exploited through malicious internet requests, prompting cybersecurity agencies to advise website operators to promptly install the security updates or, if updates were unavailable, temporarily shut down the affected sites.

However, updating PHP is not always easy, especially for smaller websites run on shared hosting platforms where owners may lack control over the server. Additionally, older systems and appliances that cannot be easily updated pose another challenge. The European Union's CERT-EU recommended that organizations unable to apply the fixes immediately take affected systems offline temporarily to mitigate potential risks.