BERLIN (dpa): A serious security flaw in the widely used internet programming language PHP has shaken the foundations of countless websites and online services worldwide.
Security experts warned of two critical vulnerabilities in the core of the programming language, dubbed "PHP2Shell" and registered under the official identifiers CVE-2026-109618 and CVE-2026-109619.
Criminals could exploit the vulnerabilities to run their own malicious code remotely on affected servers.
In practice, this could allow attackers to take full control of a website, steal sensitive customer data or misuse the infrastructure for further cyberattacks.
The EU's cybersecurity service (CERT-EU) warned on Wednesday that "organisations should consider isolating internet-facing applications from public networks until a fix can be applied."
Developers later released updated versions of the programming language on Wednesday afternoon, in which the security vulnerabilities had been patched.
The expert service Heise Security warned website operators that working scripts would appear within hours, or at the latest within a day. It said anyone wishing to avoid the risk of their system being compromised should disconnect PHP-based web servers from the internet until the update has been installed.
A large part of the internet is built on PHP, from simple blogs and major news portals to complex online sales platforms and content management systems such as WordPress.
Detailed information about the vulnerabilities was unintentionally made public in advance, putting the global IT industry under considerable time pressure. - dpa
