Patch Critical PHP Flaws Now, or Take Sites Offline

Most people never think about PHP, but it quietly runs behind a huge share of the websites they use. This week, two critical security flaws in it, now known as PHP2Shell, sent governments, businesses and website owners racing to update their servers.

The two flaws, CVE-2026-109618 and CVE-2026-109619, can let an attacker run their own code on a web server without logging in, if the server is set up in a vulnerable way. In several countries, services were taken offline as a precaution while teams patched. If a site went down this week, that doesn't mean it was hacked; often it means someone was being careful.

Fixes were released on October 21, but attackers had already started probing for weak spots. Security researchers reported millions of exploit attempts in the days that followed, though an attempt isn't the same as a successful break-in, and some failed. Researchers also saw attempts to plant malware, including a variant of the Mirai botnet.

The tricky part is that many organisations use PHP without realising it: through a hosting provider, or underneath WordPress, Drupal or Joomla. Finding every affected system matters as much as installing the fix.

On October 23, CERT-EU updated its advisory to flag a third, narrower flaw, CVE-2026-115560, which affects unusual setups. It's separate from the original two, so keep an eye on PHP's follow-up guidance.

The bigger lesson: emergency fixes are much easier when a company knows exactly what runs behind its websites, and who's responsible for updating it.

Get stories like this in your inbox every week. Subscribe to The Week in Perspective.

Sources: PHP official downloads · CERT-EU advisory · NHS England alert