ZDNET’s key takeaways

The disclosure of critical bugs in PHP leads to an urgent rush to patch.

Cybercriminals are likely to weaponize these vulnerabilities.

Organizations should act now to prevent exploitation.

A flaw in PHP triggered a worldwide scramble to patch vulnerable websites, and now, further instructions have been issued by the PHP Project to prevent “an unlikely Remote Code Execution (RCE) vector” in PHP2Shell attacks.

What is PHP2Shell?

PHP2Shell refers to a pair of PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 , that have each earned critical severity scores of 9.2 and impact most PHP builds. The PHP Project released patches to fix these bugs on Wednesday, and the critical nature of these flaws prompted a worldwide scramble to apply PHP’s fixes as quickly as possible.

Why the rush?…