"Two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 — allow unauthenticated remote code execution on millions of servers. Governments took national services offline, Cloudflare saw early attacks, and updating WordPress does not fix it. What happened, who is exposed, and what to do right now."

PHP quietly powers the back end of most of the web. W3Techs measures it on 69.3% of all websites whose server-side language can be identified. WordPress alone runs close to 40% of the web, and it sits on PHP — so do Magento, Drupal, Joomla, phpBB, WHMCS and MediaWiki. When a flaw turns up inside PHP itself, the blast radius is not one app. It is the foundation under millions of sites at once.

That is what happened this week. On Tuesday, October 20, word began spreading that two unpatched PHP vulnerabilities were about to be disclosed. Screenshots circulated, including one showing an exploit tool named PHP2Shell.…