Governments urge immediate PHP patches after critical flaws disclosed
publishers 22articles 22first reported 20 Oct, 19:27 UTCdeveloping since 21 Oct · 10 editions
Cybersecurity agencies in the United States, Singapore and Taiwan have urged organizations to immediately patch two critical vulnerabilities in PHP, a programming language widely used by websites and content-management systems.
The flaws, collectively called PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to remotely execute code and take control of affected web servers without login credentials. Singapore’s Cyber Security Agency said all PHP versions were affected and warned that exploitation could expose data or disrupt services.
PHP developers released emergency fixes Wednesday after the vulnerabilities, which had gone undetected for years, were uncovered using artificial intelligence. Taiwan’s Administration for Cybersecurity said the flaws received a severity score of 9.2 out of 10. The U.S. National Security Agency advised organizations to patch immediately or take affected systems offline.
Officials warned that active exploitation attempts were already widespread. Cloudflare chief executive Matthew Prince said the company recorded millions of attempts after the public disclosure, while multiple proof-of-concept exploits had also been developed. Some government and other websites in Europe and elsewhere were temporarily taken offline as a precaution.
Organizations were advised to identify PHP-based systems, including services using WordPress, Drupal, Joomla and Magento, prioritize internet-facing servers for updates, and inspect logs for signs of compromise. Singapore officials also urged customers using outside hosting or IT providers to confirm that those vendors had applied the fixes.
HOW THIS STORY WAS MADE
Written from 8 articles, 2 with the publisher's own text; 8 independent newsrooms once syndicated copies count as one; this version written 42 h after the record first saw the story; the editor kept it as written.
- Publishers
- 22
- Source articles
- 22
- Given to the writer
- 8, 2 with the article's own text
- Independent newsrooms
- 8
- This version written
- 42 h after the record first saw the story
- Second model (editor)
- kept as written
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and published it as written.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →