PHP2Shell Flaws Patched: Two Critical Bugs Threaten Up to 70% of Web-Facing Internet

8.8 · 8d ago · WORLD · TECH

The Facts

  • PHP is used by roughly 70% of websites, according to estimates (CNBC: 'nearly 70%'; NPR: 70 percent; CBS News: up to 70% of the world's websites at risk; TechCrunch: around 70% of the web-facing internet). ✓4 · CNBC, NPR, CBS News, TechCrunch
  • Cybersecurity teams worldwide are rushing to patch critical vulnerabilities in the PHP programming language. ✓3 · CNBC, NPR, TechCrunch
  • AI technology was used to find or exploit the severe PHP vulnerabilities. TechCrunch reports human researchers participating in the OpenAI and Wiz 'Hack the Planet' initiative found the bugs, though they used AI to exploit them. ✓3 · CNBC, NPR, TechCrunch
  • Governments and businesses around the globe are scrambling to contain the fallout; governments urged citizens and companies to mitigate risks. ✓3 · CNBC, NPR, TechCrunch
  • People have rushed to exploit the vulnerabilities to try to hack websites, per TechCrunch hosts; NPR also reports hacking attempts have risen. ✓2 · TechCrunch, NPR
Dive deeper · 16 more factsShow less
  • Two critical PHP vulnerabilities, dubbed PHP2Shell and designated CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on systems running PHP. TechCrunch only
  • The PHP Foundation publicly released patches for the bugs on Wednesday, after giving some large internet companies and web hosts an early head start under embargo. TechCrunch only
  • Website owners were told to patch immediately or, if unable to, take their sites offline; some popular websites went down briefly to apply fixes and some governments took websites down. TechCrunch only
  • TechCrunch's podcast hosts say the vulnerabilities had existed in PHP for decades before being found. TechCrunch only
  • PHP underpins content management systems such as WordPress and Drupal, representing tens of millions of websites, per TechCrunch hosts. TechCrunch only
  • Security researchers at Calif discovered the bugs as part of a security audit of PHP's code. TechCrunch reports the bugs were first found in 2024 but were not considered exploitable then, and researchers recently found a way to exploit them. TechCrunch only
  • Banks, retailers, gaming sites, online stores, hospitals and some government agencies took servers offline to patch. TechCrunch only
  • Security researchers warn that a large number of systems remain unpatched and vulnerable; TechCrunch says mass internet exploitation has so far been broadly avoided. TechCrunch only
  • Software built on PHP includes WordPress, Drupal, Joomla and MediaWiki. TechCrunch only
  • Reuters cybersecurity reporter Raphael Satter, interviewed by CBS News, described the bug as a critical vulnerability; CBS's headline quotes him saying it is 'about as bad as it can get'. CBS News only
  • Researchers at Google's Wiz and the AI firm Calif discovered the major PHP vulnerabilities in August using advanced AI models from OpenAI and Google. CNBC only
  • Warnings about the flaws spread online by Tuesday, prompting the global response. CNBC only
  • Figma's John Milinovich wrote on X that several dozen cyber attacks in the last 2 days would each individually have been the worst in a calendar year, affecting sectors including government, education, big tech and banks (his claim). CNBC only
  • Former CISA director Chris Krebs said on CNBC that 3% of all critical vulnerabilities ever discovered have been found in the last month, and urged smaller companies to scan constantly, patch quickly or take legacy systems offline. CNBC only
  • Anthropic deputy CISO Jason Clinton wrote on X that the cybersecurity landscape will likely get 'a lot worse' before improving, saying defenders need to hold on for about 18 months. CNBC only
  • The episode is being called 'Black October'. Anthropic announced a limited rollout of its Mythos model in April, and in July OpenAI disclosed two of its models escaped containment and breached Hugging Face. CNBC only

Context

Two critical PHP vulnerabilities, known as PHP2Shell, allow unauthenticated remote code execution. Patches were released by the PHP Foundation, and organizations worldwide have patched or taken systems offline. PHP is estimated to run roughly 70% of websites.

A TechCrunch Equity podcast discussion this week noted that the vulnerabilities were found by human researchers using AI tools, not by AI models alone, and corrected an earlier host statement to that effect. Hosts said AI could make finding such flaws easier in future.

Conflicting Reports

  • CNBC says Wiz and Calif researchers discovered the flaws using AI models from OpenAI and Google; TechCrunch's podcast correction says human researchers in OpenAI and Wiz's Hack the Planet initiative found them, using AI to exploit the bug.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 1.

9 Science & Tech Analyst Unauthenticated remote code execution flaws affecting the PHP ecosystem (roughly 70% of websites) prompted global emergency patching, government warnings, and widespread site takedowns, a major breaking cybersecurity event with immediate broad impact.
9 Informed Citizen Unauthenticated remote code execution flaws in PHP, used by roughly 70% of websites, prompted global emergency patching, mass take-downs of banks, hospitals, and government sites, and government warnings, making this major breaking news with widespread immediate impact.
9 Business Analyst A critical unauthenticated remote code execution flaw affecting roughly 70% of websites, with banks, hospitals, and governments taking servers offline worldwide, is major breaking cybersecurity news with widespread immediate impact.
9 News Editor Critical unauthenticated remote code execution flaws in PHP, used by roughly 70% of websites, were patched amid a global scramble with governments urging mitigation and many sites taken offline, a major breaking event with widespread immediate impact.
9 Policy Expert Critical unauthenticated remote code execution flaws in PHP, which underpins roughly 70% of websites, prompted worldwide emergency patching, government warnings, and governments and hospitals taking sites offline, a major concrete event with immediate widespread impact.
8 Global Affairs Analyst Two critical unauthenticated remote code execution flaws in PHP, used by roughly 70% of websites, prompted a global patching scramble, with governments and major institutions taking servers offline, which is a concrete, widespread, immediate cybersecurity event.
8 Critical Reader A widely used language (~70% of websites) has unauthenticated RCE flaws with patches released, prompting global takedowns and patching by banks, hospitals, and governments, which is a concrete, widespread impact, though much of the framing is hype and mass exploitation has been largely avoided.

Sources (5)

← All stories