{
  "id": 16182860,
  "title": "PHP2Shell alarm a major cyber security wake-up call",
  "url": "https://urgent.news/2026/10/23/php2shell-alarm-a-major-cyber-security-wake-up-call",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T11:27:00.000Z",
  "source": {
    "name": "ITWeb",
    "slug": "itweb",
    "url": "https://www.itweb.co.za/article/php2shell-alarm-a-major-cyber-security-wake-up-call/WnpNgM21VmP7VrGd"
  },
  "original_language": "en",
  "account": "PHP, a programming language powering approximately three-quarters of the world's websites, has been hit by two critical vulnerabilities dubbed PHP2Shell. These flaws, CVE-2026-109618 and CVE-2026-109619, could allow attackers to gain remote access to vulnerable servers without authentication. The vulnerabilities, which were identified in 2024, were reportedly leaked before their planned disclosure and patching, sparking global alarm. Researchers from California-based company Calif, alongside security firms Check Point and Wiz, discovered the flaws using AI-assisted research. The vulnerabilities have the potential to enable remote code execution, a severe form of cyber compromise, giving attackers control over affected servers. Experts advise organizations to apply patches immediately and to identify all instances of PHP running across their infrastructure. The impact of the vulnerabilities varies by region, with Europe being the most affected, followed by Africa and Kenya. Government bodies in the Netherlands and Finland also took precautionary measures. The vulnerabilities exist at a fundamental level within PHP, meaning that updating websites or plugins alone will not resolve the issue. Security teams must prioritize internet-facing systems and confirm affected versions as soon as official advisories are released. The incident underscores the increasing reliance on PHP and the urgent need for robust security measures in the digital infrastructure that underpins global services.",
  "summary": "AI-assisted research uncovers two critical PHP vulnerabilities affecting most of the web, triggering a global scramble to patch systems.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}