PHP-ocalypse: How two critical web bugs almost broke the internet

Unpatched PHP servers that were taken offline to fix critical vulnerabilities are now back online, but many remain at risk.

Two critical vulnerabilities in the widely-used PHP web programming language, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed on October 24, 2026, prompting a global scramble to patch affected systems. These bugs allowed remote code execution and unauthenticated access to internet-facing servers running PHP, posing a significant security risk. The PHP Foundation released patches after coordinated disclosure with major tech companies and web hosts. Many organizations, including banks, retailers, and government agencies, temporarily took their websites and services offline to apply the fixes. Despite these efforts, security researchers warn that many systems remain unpatched and vulnerable, with evidence of exploitation detected prior to the public release of the patches.

The discovery and patching of the PHP2Shell vulnerabilities highlight the persistent risks associated with aging, ubiquitous open-source software. While AI played a role in identifying the bugs, traditional security expertise and diligent code auditing remain paramount. The incident underscores the challenges of maintaining security for foundational internet technologies that, despite their age, continue to power a vast percentage of the web, often with limited financial support for their maintainers.

The PHP-ocalypse demonstrates the potential for a single, widespread vulnerability to disrupt a significant portion of the internet. It signals a need for continuous vigilance and proactive security measures, especially for technologies like PHP that, while declining in usage, still form the backbone of numerous critical online services. The incident also raises questions about coordinated vulnerability disclosure and the potential for information leaks in the open-source community, as exploitation was detected before official patch release.