Two critical vulnerabilities in PHP — the scripting language that runs roughly 70% of all websites with a known server-side language — have left the internet's foundational infrastructure wide open to remote takeover, and your data, your business, and your government's systems are sitting in the blast radius.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed collectively as 'PHP2Shell,' affect every PHP installation serving web requests going back to PHP version 5, released in 2004. Only PHP 8.2 and newer will receive official patches. Everything else — the forgotten, un-updated backbone of countless American small businesses, local governments, and essential services — is on its own. The PHP Foundation was blunt: "There are no complete mitigations, updating is the only safe choice."
WIRED framed the story as an five-alarm fire, quoting independent security consultant Lukasz Olejnik calling it infrastructure-level risk: "This is not a drill... Worst case is wormable malware affecting big chunks of the internet." Infosecurity Magazine led with the botched disclosure — a Hacker News forum user named 'petecooper' leaked the vulnerability identifiers a day before the coordinated patch release, potentially giving attackers a head start to reverse-engineer exploits before fixes were available.
Both outlets agree on the stakes. PHP powers WordPress, Drupal, Joomla, Magento — the platforms that run American commerce, publishing, and local government. Security and compliance consultant Davi Ottenheimer told WIRED the bug sits in a file upload interface that's "like a front door with no lock." An attacker doesn't need to target a specific site. One crafted upload to any server they find, and they're in.
Cloudflare reported "seeing early attacks emerging" before the PHP Foundation even published details. Security firm Sansec warned that mass attacks would begin within 15 minutes of the release. Olejnik noted that AI now makes exploitation nearly instantaneous — "a minute or so." Government websites in Finland, France, and the Port of Rotterdam went offline as a precaution. No American systems have been reported compromised — yet.
Here's the part Washington won't tell you: while Congress rubber-stamps hundred-billion-dollar aid packages for foreign wars with no defined exit strategy, the digital infrastructure Americans actually depend on runs on twenty-year-old code maintained by a foundation, not the Pentagon. There is no military-industrial complex profit in patching PHP. No defense contractor gets a cost-plus deal to update the WordPress installation at your local hardware store. The PHP security team — volunteers and a small foundation — is all that stands between the functioning internet and chaos.
Infosecurity Magazine noted a discrepancy in severity scoring: the leaker claimed maximum severity (CVSS 10.0), while the PHP team rated the flaws at 9.2. CERT-EU and the UK's NCSC both issued emergency advisories. Where was CISA? Quiet — at least as of publication.
Wiz, the security firm owned by Google, claimed its researchers discovered the vulnerabilities. Google buying a security firm that then finds critical bugs in open-source infrastructure is either a public service or a consolidation of power — possibly both.
The open question: how much of America's critical digital infrastructure is running unpatched, unsupported PHP right now, and who in Washington even knows — or cares?
