On Wednesday, a decades-old open-source web technology called PHP almost broke the internet, thanks to two vulnerabilities that had sat dormant for years until researchers recently figured out a way to exploit them. The bugs are dubbed PHP2Shell, officially designated as CVE-2026-109618 and CVE-2026-109619. In simple terms, the bugs allow anyone who knows how to exploit them to break into an online system running PHP, such as a website or internet-facing server, without needing a password to access or modify its data. The PHP Foundation, which maintains the PHP web software, publicly released patches on Wednesday that fixed the bugs, which when installed prevent web-facing servers from being attacked. The foundation had already given some of the biggest internet companies and web hosts that rely on PHP an early headstart on patching. Thanks to weeks of backroom chatter and careful coordination across the industry, the world ' so far ' broadly avoided mass internet exploitation. From...
learn more
