PHP Foundation patches two critical PHP2Shell bugs

The PHP Foundation released patches on Wednesday for two critical PHP vulnerabilities known as PHP2Shell, designated CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution on affected systems, according to TechCrunch.

The foundation gave large internet companies and web hosts early access to the patches under a coordinated embargo, including firms that rely on PHP. Banks, retailers, gaming sites, online stores, hospitals and some government agencies took servers offline or shut down websites to apply the fixes, and governments began urging citizens and companies with websites to mitigate the risks from Wednesday.

The two bugs were found by security researchers at Calif. They were first discovered in 2024 but were not patched or considered exploitable at the time; researchers recently found a way to exploit them and alerted the PHP Foundation, which began the coordinated fix.

Around 70% of the web-facing internet relies on PHP, which powers software including WordPress, Drupal, Joomla and MediaWiki, the software behind Wikipedia.