Two critical PHP bugs nearly disrupted internet services worldwide

TechCrunch reported that two critical bugs in the PHP web programming language, known as PHP2Shell and officially designated CVE-2026-109618 and CVE-2026-109619, nearly caused major disruptions across the internet.

These vulnerabilities allowed attackers to access or modify data on systems running PHP without needing passwords, putting millions of websites and servers at risk.

The PHP Foundation released patches on Wednesday to fix the bugs and had previously alerted major internet companies and web hosts to begin patching early.

Thanks to coordinated efforts over several weeks, widespread exploitation was largely avoided, though governments have urged all website operators to apply patches promptly.

Many industries, including banks, retailers, gaming sites, hospitals, and government agencies, temporarily took their services offline to secure their systems.

Security researchers warn that many systems remain unpatched and vulnerable, indicating the threat is not fully resolved and similar issues may arise in the future.