Two critical PHP flaws drew millions of attack attempts after going public. No break-in is confirmed, but the patch window is short.
Two serious flaws in PHP, a programming language behind a large share of websites, are being hammered by attackers. Cloudflare says it saw millions of attempts to exploit them after they became public. No successful attack has been seen so far. Still, some websites went offline as a precaution.
The PHP Foundation released fixes for two critical bugs, CVE-2026-109618 and CVE-2026-109619. Together they have been nicknamed PHP2Shell. Both could let an attacker run their own commands on a server without logging in. Security people call this remote code execution. In plain terms, a stranger could take control of the machine that runs a website.
Because PHP is so common, the bugs drew fast attention. Attackers began scanning the internet for sites that had not updated yet. Scanning is like trying doorknobs down a street. It does not mean a door has opened.
The gap between a fix and an attack is shrinking. Once a flaw is public, criminals can start testing it within hours. Waiting for proof of a break-in means waiting too long. A site that is hijacked can lose customer data, show fake pages or be used to attack others.
PHP was also not the only trouble this week. A third PHP bug, CVE-2026-115560, made the urgent list. So did fixes for Chrome, Cisco, Splunk, Atlassian, GitLab, Oracle, SolarWinds Observability and the Duplicator WordPress plugins. The report says some of these bugs need no login, some are already being used in attacks, and some still have no fix.
If you do not run a PHP site or server, the two PHP flaws do not apply to you. Even for PHP users, the report says no successful exploitation has been observed. That gives a window, but not a long one. Many small business sites run on PHP through WordPress or similar tools, so it is worth asking your provider rather than guessing.
The alert box above lists the steps. The short version: confirm the PHP patch, update your other software, and replace any password or key that may have leaked.
Expect the scanning to continue. The report also points to a software supply-chain attack that began with a leaked key, and to AI agents being tricked into following harmful instructions. Details on how many sites are still unpatched are not given. Neither is which of the listed bugs are already being exploited. Those answers will shape how urgent each update becomes.
Ask your web host or IT provider today whether the PHP fixes are installed, and do not wait for proof of an attack.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
