Cloudflare reports early attacks targeting critical PHP vulnerabilities
What happened
The PHP Foundation disclosed two critical software vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called "php2shell." The Foundation issued an emergency patch, urging websites to implement it immediately. Cloudflare reported seeing "early attacks" targeting these flaws before the patch's official release, though successful breaches remain limited and unfolding.
From fortune.com
Why it matters
Since most web pages run using PHP, the vulnerabilities pose a widespread risk to internet infrastructure. The flaws could allow attackers to steal vital data from websites if the emergency patches are not deployed quickly by operators.
From fortune.com
Who's involved
- CloudflareGlobal cybersecurity company reporting early attacks on PHP vulnerabilities.
Who could feel it
Possible knock-on effectsThese are possibilities Brind reasoned out, not predictions, and not advice. Most are not stated in any report.
- MicrosoftSpeculative
Might face increased patching costs due to the vulnerability affecting core web infrastructure.
Keep exploring
The entities involved
-
Cloudflare
American internet infrastructure and website security company