New Delhi: The internet’s plumbing has sprung a dangerous leak — and the whole world is scrambling to plug it. Two critical vulnerabilities in PHP, the open-source scripting language that powers a large share of the world’s websites, have been disclosed in what experts are calling one of the most serious software flaws in recent memory.
Dubbed “PHP2Shell”, the two flaws carry the identifiers CVE-2026-109618 and CVE-2026-109619. They were disclosed on October 21, 2026, alongside emergency security fixes released in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The vulnerabilities could allow unauthenticated remote code execution — meaning attackers can take over internet-facing servers without even needing to log in, opening the door to data theft, malware planting and full website takeover.
The scale of the exposure is enormous. PHP is used by roughly 69–70 per cent of websites worldwide, according to web technology surveys, and BusinessLine reported that about 67 per cent of ‘.in’ domain websites run on PHP. Worse, the flaws had been hiding in the PHP codebase for over a decade before being found.
The discovery itself reads like a plot from a tech thriller. The vulnerabilities were uncovered by cybersecurity firm Wiz using its autonomous detection system, working with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, as reported — a rare case of AI systems teaming up to catch a flaw humans had missed for years.
India’s cyber response agency has sounded the alarm. CERT-In issued a critical alert urging organisations to identify affected systems, apply the latest fixes without delay, and check for signs that exploitation may already have occurred. Indian companies, especially MSMEs, are rushing to patch their systems. A government official told businessline that critical sectors, including banks and power companies, have been alerted.
The global reaction has been swift. The US National Security Agency issued a warning advising organisations to patch or take affected systems offline, while the US FBI urged users and administrators to update immediately. In Europe, some governments took websites offline purely as a precaution.
The gravity of the moment was captured by Microsoft CEO Satya Nadella, speaking at an event in Germany on Thursday. “I’ve not seen anything like this in a long, long time,” he said — a verified remark that summed up the mood across the tech industry.
For website owners and system administrators, the message is simple and urgent: update PHP now, and verify your servers for any trace of compromise. In a world where nearly seven in ten websites run on PHP, there is no room for complacency.
