PHP2Shell Flaws Trigger Emergency Patches and Widespread Shutdowns
PHP released fixes for two critical, unauthenticated remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Government, hospital, university and commercial services in Europe and Asia were temporarily taken offline while operators patched, after reports of early exploitation. OpenAI said GPT-5.6 Sol helped researchers identify the flaws, although agencies differed on whether exploitation had been confirmed.
The flaws affected PHP 8.2 through 8.5 and could allow unauthenticated code execution, prompting emergency maintenance across a technology used by a large share of websites.
Government, hospital and university websites across Europe went dark on Wednesday. Operators pulled them offline to guard against two critical flaws in PHP, the programming language that runs a large share of the web. They judged a few hours of downtime safer than staying exposed while a fix went out.
The shutdowns followed a warning from CERT-EU, the EU’s cyber agency. It had told organisations that could not patch in time to take sites offline. PHP’s developers released the fix on Wednesday afternoon, Reuters reported. It covers two PHP security flaws rated 9.2 out of 10 that let an attacker run code on a server without logging in.
#PHP#PHP Foundation#PHP2Shell#OpenAI#GPT-5.6 Sol#Calif#Wiz#Cloudflare#CERT-EU#Wikimedia Foundation#Amazon Web Services#NSA