Governments urge immediate patching of critical PHP flaws amid exploitation attempts
publishers 24articles 25first reported 20 Oct, 19:27 UTCdeveloping since 21 Oct · 10 editions
Cybersecurity agencies worldwide have urged organizations to immediately patch two critical vulnerabilities in PHP, warning that attackers could exploit them to remotely take control of affected web servers without login credentials.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619 and collectively called “PHP2Shell,” affect all PHP versions, according to Singapore’s Cyber Security Agency. PHP developers released emergency fixes Wednesday after the vulnerabilities, which had reportedly gone undetected for years, were found with the aid of artificial intelligence.
Singapore Commissioner of Cybersecurity Gwenda Fong said working exploits had been demonstrated and advised organizations to prioritize internet-facing systems, investigate possible compromises and contact vendors or hosting providers if they were unsure whether their services were affected. Cloudflare chief executive Matthew Prince said the company recorded millions of exploitation attempts after public disclosure.
The U.S. National Security Agency also told organizations to patch immediately or take affected systems offline. Agencies in Singapore, Taiwan, Australia, the United Kingdom, Europe and Japan issued similar warnings. Several government websites and other services in Europe, including websites operated by the Port of Rotterdam, were taken offline as a precaution.
PHP is widely used by websites and platforms including WordPress, Drupal, Joomla and Magento. Taiwan’s Administration for Cybersecurity rated the two flaws 9.2 out of 10 under the CVSS v4.0 system and advised organizations to review logs and unusual access after updating.
HOW THIS STORY WAS MADE
Written from 8 articles, 3 with the publisher's own text; 8 independent newsrooms once syndicated copies count as one; this version written 66 h after the record first saw the story; the editor kept it as written.
- Publishers
- 24
- Source articles
- 25
- Given to the writer
- 8, 3 with the article's own text
- Independent newsrooms
- 8
- This version written
- 66 h after the record first saw the story
- Second model (editor)
- kept as written
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and published it as written.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →