PHP2Shell Bugs Patched After Global Web Threat — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PHP Foundation released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, after coordinated disclosure, allowing remote code execution without authentication.
- Calif researchers discovered the PHP bugs during a security audit and used AI as an assistive tool, though emphasized that deep expertise in PHP’s codebase was central to the discovery.
- Amazon detected exploitation attempts of the PHP vulnerabilities a week before public disclosure, suggesting attackers had early access to the exploit method.
- OpenAI and Wiz supported the discovery through the 'Hack the Planet' initiative, which helped verify the proof-of-concept exploits developed by Calif.
- Palo Alto Networks and Trail of Bits confirmed post-exploit activity by late Friday, indicating successful breaches had already occurred despite patching efforts.
- 70% of web-facing systems rely on PHP, including major platforms like WordPress, Wikipedia, and Drupal, amplifying the risk and urgency of patching across banks, hospitals, and government sites.
Why it matters: The vulnerabilities exposed a systemic risk in foundational open-source software maintained by unpaid developers, while confirmed breaches mean damage is already underway. With PHP embedded in firewalls, routers, and enterprise tools, unpatched legacy systems will remain vulnerable long after the immediate crisis fades, increasing long-term exposure for organizations with limited IT resources.
Ask SkimNews
