Two critical flaws in PHP, the programming language that runs a large part of the web, can let hackers run their own code on servers from afar without logging in, putting millions of internet-facing services at risk.
Known together as PHP2Shell, the flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP rates both 9.2 on the CVSS v4.0 scale, which makes them critical. PHP has released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but security firms warn that a large number of servers are still unpatched or running versions that no longer get support.