Two PHP flaws let attackers take over unpatched servers with no password. TechCrunch says the web avoided mass attacks, but many systems remain exposed.
For a few days this week, a lot of the web went quiet on purpose. According to TechCrunch, two bugs in PHP, the decades-old open-source language behind a huge share of websites, forced banks, retailers, hospitals, gaming sites and some government agencies to pull servers offline so they could patch. The immediate crisis seems to have been contained. The clean-up is not finished.
What PHP2Shell is
The flaws are nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. TechCrunch says they let an attacker break into a system running PHP without a password, and over the internet, with nobody needing to click a link or open a file. Security people call that unauthenticated remote code execution, and it's about as bad as bug categories get, since it can hand over effectively full control of an unpatched server.
PHP is everywhere. TechCrunch puts it at around 70% of the web-facing internet and notes it sits underneath WordPress, Drupal, Joomla and MediaWiki, the software that runs Wikipedia.
How it was found and fixed
Researchers at the security firm Calif found the bugs while auditing PHP's code, as part of a Hack the Planet initiative from OpenAI and the cloud security company Wiz, which verified their proof-of-concept exploits. TechCrunch reports the flaws were first spotted in 2024 but weren't thought exploitable, so they were left alone until the researchers worked out a way to use them. Calif says AI helped with the exploitation but that most of the work leaned on what its team already knew about PHP. "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now," the firm wrote.
Calif told the PHP Foundation, which prepared fixes under embargo and gave some of the biggest internet companies and hosts a head start. Public patches landed on Wednesday. Because of that quiet coordination, TechCrunch says, mass exploitation was broadly avoided, so far.
The part that's still open
Here's the uncomfortable detail. Amazon wrote in a blog post that it saw PHP2Shell being exploited about a week before the patches were public, and told defenders to look for signs of attack going back to Oct. 17. Amazon said it didn't know how the attacker learned of the bugs. TechCrunch lays out the possibilities: a leak somewhere in the embargo, hackers finding the flaws on their own, or espionage. None is confirmed.
The games world felt it too. Eurogamer reported that Final Fantasy 14 temporarily turned off new logins while it hardened its patch servers, and that Umamusume: Pretty Derby went fully offline, with its developer saying no exploitation had occurred. The dinosaur MMO Path of Titans was taken down for up to three days as a precaution, its developer said.
Our take
This is analysis, not reporting. The patch itself is the easy bit; getting every old server and forgotten intranet site updated is not. Security researchers told TechCrunch that plenty of systems remain unpatched and exposed. If you run a PHP site yourself, or rely on someone who does, it's worth asking whether the update has actually been applied.
Picture credit: The PHP Group (php.net)
