Critical PHP2Shell vulnerability threatens a large portion of websites. What does it mean for you?

The European cybersecurity team CERT-EU warns of a pair of critical vulnerabilities in the PHP language, which powers a large part of the internet. Government agencies in several countries have preemptively shut down some of their websites because of them. What exactly happened, and does it affect you?

What is PHP2Shell?

PHP is the language that powers a large portion of websites – news sites, e-shops, and blogs. According to W3Techs, it is used by 69.3% of websites where the technology is known. Many of them are built on the WordPress content management system, and Svět Androida is among them.

According to CERT-EU’s alert, these are vulnerabilities CVE-2026-109618 and CVE-2026-109619 with a severity rating of 9.2 out of 10. They allow an attacker to execute their own code on the server without any password. In layman’s terms: a stranger could take control of the website, change its content, or extract data from it.

Details were supposed to remain confidential (under embargo) until the patches were released, but some information leaked earlier. According to their announcement, PHP developers released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21. Versions 8.1, 8.0, and 7.4 received only minimal emergency adjustments; for even older versions, PHP developers did not release a patch. According to the developers, no other complete solution exists besides updating.

What might you notice?

You don’t need to update anything on your phone or computer; the vulnerability is on the servers, not in your devices. Nevertheless, it might affect you:

• some websites may be temporarily unavailable – CERT-EU recommends administrators who cannot update immediately consider disconnecting them from the internet,
• file uploads may stop working on websites, such as photos for an advertisement or attachments for a form.

According to Reuters, cited by ČTK, authorities in the Netherlands, France, and Finland, for example, have already preemptively shut down some of their websites.

If a popular website starts behaving strangely – redirecting you elsewhere or unexpectedly asking for login credentials or payment – do not fill in anything. And if a website you use reports a data breach, change your password there and everywhere else you use the same one. Do you have your own website? Ask your hosting provider if they have already updated PHP.

What role does artificial intelligence play?

The vulnerabilities were discovered by the security firm Wiz, which states that AI models helped them find the vulnerability and verify the fix. However, the same tools can also help attackers.

How is Svět Androida doing?

Our hosting is provided by Lynt. Its CTO, Vladimír Smitka, stated on X that the team is monitoring traffic and has prepared to disable file uploads as the least invasive defense. According to him, the exploits, or instructions for misuse, circulating on the internet did not lead him to the actual vulnerability.

No one knows yet whether this will be similar to the “Y2K problem,” which, thanks to timely fixes, passed without major damage, or a wave of actual attacks. According to its CTO, Cloudflare has already detected the first attempted attacks. We will continuously update the article.

Have you encountered a website that won’t load or is behaving strangely?

Sources: CERT-EU, PHP.net, Wiz