PHP developers release emergency patches after critical flaws discovered
Government agencies and tech operators across Europe and international markets pulled websites offline on October 21, 2026, following the disclosure of critical vulnerabilities in PHP, a programming language that underpins up to 70% of the world’s web platforms. Las fallas, designadas como CVE-2026-109618 y CVE-2026-109619 y colectivamente rastreadas como PHP2Shell, permiten la ejecución remota de código sin autenticación.
Global Digital Infrastructure Strains Under PHP2Shell Vulnerabilities
The security gaps inside PHP have persisted unnoticed for more than a decade, according to findings published by bbc.com. The discovery marks one of the most significant digital security events in recent years, as artificial intelligence tools deployed by security firms Calif and Wiz successfully located the flaws, as reported by Gizmodo en. Volker Dusch, a security engineer for the foundation that administers PHP, told the Wall Street Journal in coverage cited by BioBioChile that the issue represents the most severe security threat facing the programming language in over ten years.
The defects enable malicious actors to seize control of web servers, harvest sensitive data, and hijack digital infrastructure without requiring any user authentication. Because PHP functions as the foundational backend for major content management systems including WordPress, Drupal, Joomla, and Magento—affecting platforms that range from public wikis to enterprise e-commerce portals—the scope of potential exposure is vast, per df.cl and dw.com. While estimates indicate PHP powers roughly 70% to 75% of websites with identifiable programming languages according to data tracked by W3Techs cited in df.cl, security firms emphasize that widespread installation does not mean every system is currently compromised.
Developers Release Emergency Patches as Public Institutions React
Developers of the programming language issued a set of emergency patches on October 21, 2026, releasing versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to remediate the flaws, as noted by dw.com and Gizmodo en. The release schedule was accelerated after technical details were prematurely leaked on Hacker News, forcing security teams to release corrections before scheduled deployment dates, according to BioBioChile.
Public institutions reacted swiftly to the warnings. In France, the Ministry of the Interior disconnected several local administrative web pages, while municipalities in Germany, including Mainz, powered down official municipal portals while maintaining citizen services through telephone and email channels, as reported by df.cl and dw.com. In the Netherlands, the national cyber security agency temporarily removed its own internet portal, and similar defensive takedowns occurred across government servers in Australia, Japan, and the United Kingdom, according to bbc.com and df.cl.
Organizations Must Apply Updates or Isolate Legacy Installations
Organizations operating PHP-backed environments must coordinate immediately with system administrators and hosting providers to apply the newly issued software updates or isolate legacy installations that lack active vendor support.