PHP-ocalypse: How two critical web bugs almost broke the internet
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.
On Wednesday, two critical vulnerabilities in PHP, a widely-used web technology, posed a significant threat to the internet. These bugs, known as PHP2Shell (CVE-2026-109618) and CVE-2026-109619, allowed unauthorized access to online systems running PHP without requiring a password. The PHP Foundation, which maintains PHP, issued patches to fix the bugs, but the impact was widespread, forcing millions of users to patch their systems before malicious exploitation could occur.
Major companies and web hosts received early access to the patches, and many promptly took action to secure their systems. Governments advised citizens and businesses to mitigate risks, leading to widespread website shutdowns and service disruptions. Banks, retailers, gaming sites, online stores, hospitals, and some government agencies temporarily disabled their servers to prevent attacks.
Although the situation was largely contained, security researchers warned that many systems remained unpatched, placing them at risk of future attacks. The PHP Foundation had already given leading tech companies a heads-up on the vulnerabilities, and AI-assisted researchers from Calif discovered the bugs while participating in the Hack the Planet initiative by OpenAI and Wiz.
Despite efforts to keep the bugs undisclosed, it seems some exploitation had already occurred, raising concerns about the security of PHP and the need for ongoing vigilance in the face of evolving threats.
Written by urgent.news from TechCrunch's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
