Last week, details emerged about a pair of critical vulnerabilities in PHP, a server-side scripting language commonly used in web development. The news prompted security advisories from government agencies and sent website owners scrambling to apply the patches, with some sites even going offline as a precaution. This is because on an unpatched server, an attacker can exploit the vulnerabilities to run their own code without logging in. As three out of four websites globally are estimated to use PHP in some capacity, its ubiquity helps create an environment ripe for abuse; indeed, initial attempts to exploit the flaws – discovered by AI and dubbed PHP2Shell – weren't long in coming.
Here's what to know about CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes.
For detailed mitigation steps and other information, refer to the advisories issued by the PHP Project, CISA, CERT-EU or NCSC.
