Critical web security flaw puts millions of websites at risk. What does it mean for you?
A screen shows live cybersecurity threats at NTT DATA’s Cyber Defense Center in Plano, Texas, on Oct. 9, 2026. A critical security flaw in PHP, software that runs behind much of the internet, has triggered a global scramble to patch websites.
TL;DR
- Two critical security flaws in PHP, software powering about 70% of websites, have been uncovered.
- These vulnerabilities could allow hackers to take control of web servers without passwords.
- Governments and technology companies are rushing to install fixes, with some websites temporarily taken offline.
- The vulnerabilities affect web servers, not users' devices directly, but could lead to data theft or service disruption.
- Cybersecurity firms have detected a surge in attempts to exploit these flaws.
- PHP is widely used, powering sites built on platforms like WordPress and Drupal, making the flaw a significant concern.
- The vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have a severity rating of 9.2 out of 10.
- Organizations are urged to inventory systems, install patches, or take vulnerable systems offline.
- One flaw was reportedly discovered with the help of an advanced OpenAI model.
- Users are advised to remain skeptical of suspicious communications and keep their devices and software updated.