Reference video
Millions of servers are vulnerable to remote code execution.
CISA has added two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog. These flaws allow unauthenticated remote code execution and were patched by the PHP Foundation in October 2026.
CISA has ordered U.S. civilian federal agencies to patch their systems by October 29. Censys estimates that over 32.51 million PHP services remain vulnerable to these exploits.
The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.
The Hacker NewsThe flaws have a CVSS score of 9.2.
The Hacker NewsPatches for the vulnerabilities were released on October 21, 2026.
The Hacker NewsCensys estimates over 32.51 million PHP services remain vulnerable.
The Hacker NewsAdel Karimi of Perplexity verified the remote code execution using honeypot systems.
The Hacker NewsA suspected China-nexus actor used these flaws and a Linux kernel bug (Fragnesia) to root 25 servers, including three U.S. government-affiliated systems.
The Hacker NewsPalo Alto Networks warned that threat actors are exploiting these flaws in its internet-exposed management interfaces.
The Hacker NewsPalo Alto Networks management interfaces are being actively targeted by attackers using PHP2Shell vulnerabilities to achieve remote code execution.
CISA has ordered federal agencies to patch critical PHP vulnerabilities being actively exploited by hackers, highlighting a new risk posed by AI-assisted hacking.
CISA has confirmed that two critical PHP2Shell vulnerabilities enabling remote code execution are being actively exploited, prompting urgent patching requirements for federal agencies and global vendors.
The vulnerability of the web's foundational plumbing
The discovery of PHP2Shell vulnerabilities exposes a critical weakness in the software that powers a vast portion of the internet. Because these flaws allow unauthenticated remote code execution, an attacker can take full control of a server without needing a password. The scale of the risk is immense, with over 32.51 million services estimated to be vulnerable.
This situation highlights a structural fragility where the global digital economy relies on open-source foundations that often lack the funding and manpower to keep pace with evolving threats. When a core component of the web's infrastructure fails, the impact ripples across government systems and private enterprises alike, forcing a race between administrators and attackers to apply patches.
Between technical urgency and the AI narrative
Coverage is split between immediate technical warnings and broader systemic analysis. The Hacker News focuses on the operational reality, detailing how specific threat actors are combining these flaws with other bugs to root servers and identifying the CVSS score of 9.2 to signal urgency. It provides the concrete data readers need to understand the immediate threat level.
TechCrunch shifts the lens toward a structural narrative, claiming that AI models have made previously impractical exploits viable. This framing suggests a new era where aging open-source code becomes a liability due to AI-driven exploitation. While this provides a provocative context, it contrasts with the more direct reporting on the current exploitation patterns. The coverage collectively succeeds in highlighting the scale of the risk, though the tension remains between treating this as a routine patching cycle or a symptom of a deeper technological shift.
News Story
Card 3 of 3 in this story
This card follows “PHP security team announces emergency security release”
Loading comments...