Two critical vulnerabilities in PHP, a widely-used open-source web programming language, have been identified and are being rapidly exploited. These vulnerabilities, named PHP2Shell and officially designated as CVE-2026-109618 and CVE-2026-109619, allow unauthorized access to systems running PHP without requiring a password. The PHP Foundation has responded by releasing patches to address these security flaws, and millions are urgently updating their systems to prevent exploitation.

The vulnerabilities were discovered by security researchers at Calif as part of a security audit of PHP's code. Their findings triggered an immediate response from the PHP Foundation, which coordinated with major internet firms to roll out patches. Despite these efforts, some systems remain unpatched, leaving them vulnerable to potential attacks.

PHP is a backbone of the internet, powering approximately 70% of web-facing systems, including popular platforms like WordPress and Joomla. Given its widespread use, the discovery of these vulnerabilities has prompted a global scramble to secure systems across various sectors, including finance, retail, and healthcare.

While many companies have taken measures to safeguard their systems, security experts warn that the threat is not yet over. Reports of exploitation have emerged, with some malicious actors having gained early knowledge of the vulnerabilities. This underscores the importance of swift action to patch systems and monitor for signs of unauthorized access.

The situation highlights the challenges faced by open-source communities in maintaining security, especially when resources are limited. As AI technology advances, the potential for uncovering previously unknown vulnerabilities increases, necessitating vigilant and proactive security measures.