PHP Foundation Issues Patches for Critical Vulnerabilities Targeted by Attackers
- Reports
- 7
- Developments
- 3
- Repetition
- 57%
New informationRepeats or wire copies
What happened
The PHP Foundation disclosed two critical software vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called “php2shell,” and issued an emergency patch. Cloudflare reported seeing early attacks targeting these flaws. Amazon Web Services also discovered attempts to exploit the flaws, noting activity from Canadian IPs.
From fortune.com, pcmag.com
Why it matters
The vulnerabilities affect PHP, a language used by an estimated 70% of websites. There is concern that hackers may use AI models to exploit sites that have not yet installed the necessary fixes. The rapid exploitation attempts put pressure on web operators to deploy security updates quickly to prevent data theft.
From fortune.com, pcmag.com
Who's involved
- CloudflareGlobal cybersecurity company reporting early attacks targeting the flaws.
- Amazon Web ServicesDiscovered signs of exploitation attempts targeting the PHP flaws.
Who could feel it
Possible knock-on effectsThese are possibilities Brind reasoned out, not predictions, and not advice. Most are not stated in any report.
- GoDaddySpeculative
Could face increased operational costs and liability risk for hosting PHP sites due to active exploitation attempts.
- MicrosoftSpeculative
May face increased patching costs as the vulnerability affects core web infrastructure used by the company.
- Government of CanadaSpeculative
Could face increased security costs and risk exposure due to malicious probing originating from within the country.
- Amazon Web ServicesSpeculative
Might face increased operational costs and security burden due to widespread PHP vulnerability exploitation across cloud infrastructure.
Possible ripples
Who this could reach next, traced step by step from the reporting. Possibilities worth considering, not forecasts.- PHP vulnerability crisis may shift demand toward Fastly and competitorsThe PHP vulnerability crisis may shift customer demand toward secure web infrastructure providersPossible
- Microsoft.com may face risk from widespread PHP vulnerabilitiesMicrosoft may face risk from widespread PHP vulnerabilitiesPossible
How it developed
Newest first. Tap a step to see who reported it.Cloudflare takes protective action against PHP vulnerability; analyst lowers price target.1 source
Cloudflare reports early attacks on PHP vulnerabilities.1 source
Amazon discovered exploitation attempts targeting PHP flaws, while Cloudflare noted activity from Canadian IPs.1 source
Keep exploring
The entities involved
-
Cloudflare
American internet infrastructure and website security company