Millions of websites on red alert – PHP rushes emergency patches for two server takeover vulnerabilities

17 hours ago

3 min read

Millions of servers worldwide are entering a tense race against time. The security team of the PHP project – the engine powering the majority of websites today – has just announced the emergency rollout of fixes to resolve two exceptionally severe security vulnerabilities. The window from when the alert was issued to the release of the patches is less than a day, forcing system administrators to immediately go on standby.

php-vulnerability — *PHP rushes emergency patches for two server takeover vulnerabilities*

Nature of the two RCE vulnerabilities and maximum alert level

The two newly disclosed vulnerabilities carry the identifiers CVE-2026-109618 and CVE-2026-109619. Under the international standard CVSS v4.0 metric, the PHP security team scored these flaws at 9.2/10. However, several independent cybersecurity analysis organizations assess the severity at the absolute maximum: 10/10.

Both fall into the category of Remote Code Execution (RCE) vulnerabilities. Put simply, an external attacker can send malicious code to execute commands directly on the server without administrative credentials or the owner's authorization. Once gaining control at the server level, hackers can manipulate data, deploy ransomware, or disrupt entire online business operations.

Tech forum leak and early emergence of exploit tool

The decision to accelerate the patch release schedule stemmed from technical details having already been leaked. Specifically, an account named "petecooper" published a post on the tech forum Hacker News revealing detailed information on PHP's two severe RCE flaws along with the originally planned disclosure timeline.

Although the post was swiftly deleted, the data was still captured by cybersecurity firms. Even more concerning, the security community documented a leaked video demonstrating a tool dubbed "PHP2Shell." This tool has reportedly shown the capability to exploit the vulnerabilities and take over servers across a wide range of popular web platforms, including WordPress, Magento, Drupal, and Joomla. With the exploit tool already surfacing in the wild, the threat of attack has become more imminent than ever.

Risk of attack outbreaks on outdated versions

The scale of impact for this patch cycle is particularly massive. Figures from W3Techs indicate that PHP powers 69.3% of all websites globally with a known server-side programming language.

The greatest challenge lies in the reality of software version adoption. Although the PHP project currently maintains technical support only for branches 8.2 through 8.5, reports from cybersecurity researchers indicate that these two vulnerabilities may retroactively affect older branches, including PHP 5 and PHP 7. In fact, up to 27% of websites still run PHP 7, and more than 7.7% continue to operate on PHP 5 – which launched back in 2004 and has long ceased receiving official security patches. Consequently, more than one-third of PHP-based websites are running on platforms no longer protected by the developers.

Information security experts assess that just 15 minutes after the official patches are released, cybercriminals will dissect the remediation source code to develop automated attack scripts targeting systems that are slow to patch.

What should administrators do immediately ahead of PHP's vulnerabilities patch release?

To avoid being caught off guard, system administrators and website-owning enterprises must promptly take the following steps:

Immediately verify the PHP version running on the server using the simple command: php -v.
Prepare service downtime plans and allocate technical personnel to apply updates as soon as the patch source code is published on the official php.net.
If the website operates in a shared hosting environment, contact the infrastructure provider immediately to confirm their system software update schedule.

Proactively mitigating risks with the solution ecosystem from IPSIP Vietnam

To bolster defense capabilities against wide-scale cyberattack campaigns, enterprises need to combine proactive security assessments with continuous system monitoring.

In line with guidance from IPSIP Vietnam, deploying Penetration Testing (PENTEST) alongside periodic Vulnerability Assessment helps pinpoint weaknesses in web infrastructure, particularly applications running legacy software versions vulnerable to remote exploitation. In parallel, combining a Security Operations Center (SOC 24/7) with Managed Firewall services enables early detection of suspicious reconnaissance activity, traffic analysis, and the mitigation of potential intrusions. Maintaining a timely update and patching routine alongside a multi-layered defense architecture will empower enterprises to minimize attack risks, safeguard critical data, and maintain operational resilience amidst increasingly complex cybersecurity threats.