PHP Releases Emergency Patches for Two Critical Flaws Threatening the Entire Web

A PHP Foundation liberou nesta quarta-feira (21) correções de emergência para duas vulnerabilidades críticas que afetam praticamente todo site rodando PHP, da linguagem por trás do WordPress a plataformas de e-commerce como Magento.

What the PHP Foundation Fixed

On the morning of this Wednesday (21st), just before 10am Eastern Time (ET) in the United States, equivalent to roughly 11am in Brasília, the PHP Foundation published emergency updates for two vulnerabilities cataloged as CVE-2026-109618 and CVE-2026-109619. According to the official advisory itself, the flaws affect "all PHP installations that handle web requests" since version 5, released in July 2004.

In practice, only those running PHP 8.2 or newer will receive an official patch from the project, since earlier versions have already left the support cycle. The Foundation noted that some Linux distributions and third-party vendors still maintain fixes for legacy versions, but the warning is explicit: "There is no complete mitigation, updating is the only safe option," the organization wrote in its advisories.

Both flaws received a score of 9.2 out of 10 on the CVSS (Common Vulnerability Scoring System) scale, a critical severity rating. An earlier advisory, without technical details, had already been published by the Foundation on October 20 to give security teams time to prepare before the full disclosure.

A "Front Door With No Lock"

The attack's entry point is a file upload interface, a component present in virtually any PHP application that accepts user-submitted data. Security consultant Davi Ottenheimer summarized the problem directly.

Most of the web runs on PHP and this bug is in a file upload interface that's like a front door with no lock. An attacker does not need to know which site they are hitting or even the actual software it runs. They send one crafted upload to any server they can find, and that is the entire attack.

Davi Ottenheimer, security and compliance consultant

This explains why exploitation doesn't depend on prior reconnaissance of the target: it's enough to scan the internet en masse, firing the same payload at any server that responds in PHP.

Who Found the Flaw, and Who's Already Attacking

Wiz, a cloud security company acquired by Google, says its researchers discovered the vulnerabilities using AI tools as part of the process. Independently, OpenAI and security firm Calif say they arrived at the same flaws and later joined forces. Wiz named its exploit demonstration php2shell and described the scenario in technical terms.

The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.

Wiz research

Even before the official publication of details, Cloudflare was already reporting "initial attacks emerging." Security firm Sansec had written, hours before the release, that it expected "mass attacks starting within 15 minutes of the release."

Why the Reach Is So Large

Independent consultant Lukasz Olejnik, a senior visiting researcher at King's College London, compares PHP to critical infrastructure given its scale of use: publishing systems like WordPress and Drupal, e-commerce platforms like Adobe's Magento, and countless internal corporate applications depend on the language.

This is not a drill.

Lukasz Olejnik, independent security consultant

Olejnik estimates that millions of systems could be affected and describes the worst possible scenario: "worm-type malware affecting large portions of the internet," should attackers manage to automate exploitation quickly. He also points to an amplifying factor: AI tools turn exploitation of flaws like this one into a matter of minutes, not days.

Who Has Already Taken Sites Offline as a Precaution

Even before the fixed versions became generally available, some organizations chose to shut down their systems as a preventive measure. Multiple Finnish government sites, including that of the National Land Survey, became inaccessible. French government sites and the Port of Rotterdam also went offline, according to Reuters reports.

For those operating PHP infrastructure in Brazil, the warning applies as well: legacy, outdated environments without an official patch are exactly the kind of scenario most exposed to an attack like this one, which doesn't depend on prior reconnaissance of the target and can hit any vulnerable PHP server found during the scan.

What to Do Now

The NCSC (the United Kingdom's cybersecurity agency), EU-CERT, and Australia's cybersecurity agency issued alerts recommending that IT teams prepare for immediate updates as soon as the details were published. The NCSC's practical guidance follows a clear sequence:

• Identify all systems running PHP in the organization's infrastructure, with special focus on those exposed to the internet;
• Monitor these systems for signs of exploitation while the patch has not been applied;
• Apply PHP updates as soon as they are available for the version in use;
• Check for updates from software vendors that embed PHP in their own products or services;
• When an immediate fix is not viable, consider taking the system offline until full mitigation is possible.

If the Attack Has Already Happened

If signs of compromise have already been found, the FBI's guidance is to isolate the environment before taking any other action. The agency's cyber assistant director, Brett Leatherman, detailed the steps in an online post.

If you find signs of compromise, isolate the system, preserve your web server and PHP logs, and report it to your local FBI field office. Those reports help us identify the actors involved and warn other organizations before they become victims.

Brett Leatherman, FBI cyber assistant director

The PHP Foundation reserved the right to move up future releases should vulnerability details leak or there be evidence of active exploitation ahead of schedule, which, according to reports from Bleeping Computer and Ars Technica, may have already happened partially in this case, with information about the flaws leaking before the official disclosure.

Source

Wired: "'This Is Not a Drill': Critical PHP Vulnerabilities Are Setting the Internet on Fire" (https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/)