Two significant security vulnerabilities in PHP, a foundational programming language for a vast portion of the internet, have caused widespread disruption, forcing government websites in several European countries and other regions to temporarily shut down. These flaws, detected with the aid of Artificial Intelligence, have put the global technology industry on high alert regarding cybersecurity risks.
Understanding PHP and the Core Vulnerabilities
PHP, or Hypertext Preprocessor, was first introduced in the mid-1990s and serves as the server-side engine for approximately 70% of all websites whose language can be identified. Major platforms like WordPress, Drupal, Joomla, and Magento, along with Wikipedia's MediaWiki software, rely heavily on PHP to process user interactions such as logins, searches, and checkouts.
The recently identified flaws, collectively dubbed “PHP2Shell,” are tracked as CVE-2026-109618 and CVE-2026-109619, both carrying a high severity rating of 9.2 out of 10. Cybersecurity firm Wiz reported that these vulnerabilities could enable attackers to execute their own code on a web server without requiring authentication. Additionally, they could allow unauthorized access to sensitive leftover data in the server's memory, including passwords and access keys.
Alarmingly, nearly every PHP version dating back to PHP 5.4 is reportedly affected, with Palo Alto Networks identifying over 22.6 million potentially vulnerable instances globally. The speed at which AI-powered security tools are advancing is a double-edged sword; while AI helped researchers discover these vulnerabilities, malicious actors could also leverage similar tools to find and exploit new weaknesses even faster.
Widespread Impact and Mitigation Efforts
Following the disclosure of these vulnerabilities, early attacks were observed, prompting Amazon Web Services to confirm widespread exploitation. The immediate lack of a patch led many operators to take their systems offline as a precautionary measure. The US National Security Agency (NSA) advised organizations to disconnect any system that could not be updated immediately.
The repercussions were felt across multiple sectors and regions:
- Netherlands: Government websites including Overheid.nl, MijnOverheid, and DigiD, along with the Port of Rotterdam, hospital websites, political party sites, and the National Cyber Security Centre’s public-facing sites, were affected.
- France: The Interior Ministry confirmed that local government administrative websites were taken offline while fixes were implemented.
- Finland: State IT provider Valtori temporarily shut down public government network services.
Beyond government entities, businesses and non-profit organizations also experienced disruptions. US-based HR software firm BambooHR warned customers in the US, Canada, and Ireland of potential payroll issues. The Internet Archive also faced a temporary outage, and the Wikimedia Foundation proactively took several systems offline to safeguard against potential attacks.
The incident underscores the critical importance of robust cybersecurity measures and the challenges posed by vulnerabilities in widely used foundational software components like PHP.