Critical PHP bugs threaten widespread web services
Two critical bugs were discovered in the PHP programming language, which powers the majority of internet sites, and they threatened to upend the internet. Experts say fixing the flaws is not as simple as clicking “Update” and advise assessing risk and taking protective steps.
Why it matters: PHP’s ubiquity means the vulnerabilities could impact a large portion of web applications and services.
Read the coverage
This story so far
How it developed, day by day.
Sunday 25 October
Critical PHP bugs threaten widespread web services (this page)
Saturday 24 October
PHP team releases mitigation steps for new remote code execution flawFriday 23 October
Hackers exploited PHP2Shell bugs four days before patches releasedThursday 22 October
PHP releases emergency patches for two critical PHP2Shell RCE flaws (CVE‑2026‑109618, CVE‑2026‑109619)Wednesday 21 October
PHP warns of two critical flaws, emergency patches due tomorrow
More in Tech
Tech13h ago3 sources
Tech19h ago3 sources
Tech18h ago3 sources
Tech8h ago2 sources