Internet Backbone Bug Sparks Panic

cybersecurity operations room with large data dashboards and people discussing — Photo: Arnold O. A. Pinto / Shutterstock

A flaw in the coding language that powers much of the internet could let hackers take over websites without even needing a password, and attackers are already testing it.

Quick Take

The PHP Foundation rushed out emergency patches on October 21 for two critical flaws rated 9.2 out of 10 in severity.
The bugs, nicknamed PHP2Shell, let attackers run code on a server without logging in first.
Cloudflare says it has already spotted early attempts to exploit the flaws.
Security agencies told website owners to patch immediately or take affected systems offline.

Emergency Patches Target Two Critical Flaws

The PHP Foundation released emergency updates on October 21, 2026, to fix two serious security bugs in the programming language. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Together they’re known as PHP2Shell. The fixes landed in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team says only updating to these versions fully protects a server.

What Makes These Bugs So Dangerous

Both flaws let an attacker run code on a web server without ever logging in. That’s called unauthenticated remote code execution. It means hackers don’t need a stolen password or any inside access. They just need a vulnerable server to find. Researchers at Calif, Wiz and OpenAI discovered the flaws and reported them before the public patch came out.

The PHP security team scored both bugs 9.2 out of 10 using the newest severity scale, called CVSS v4.0. That score puts them in the “critical” category, the highest danger level security experts use. The flaws affect PHP itself, not just one app built with it. That means any website or program built on PHP could be at risk until it’s patched.

Leak Forced an Early Warning

The PHP project had originally planned a quiet, scheduled fix. That changed after details about the flaws leaked online and a major internet infrastructure company reported seeing early attacks. The European Union’s cyber response team, CERT-EU, published its own advisory the same day, warning organizations across Europe to prepare for the release.

Cloudflare, a company that protects millions of websites from online attacks, said it is already seeing attempts to exploit the flaws. The company pushed out emergency protective rules for sites it shields, calling the move a stopgap measure until website owners can fully patch their systems.

Security Agencies Urge Immediate Action

Government cybersecurity officials have told website operators there is no safe middle ground. The guidance is blunt: patch right away, or disconnect the affected system from the internet entirely. Because the flaws require no login to exploit, any exposed PHP server is a potential target. The PHP team has offered no official workaround short of installing the fix.

Severity Scores Don’t Always Mean Active Attacks

A high severity score like 9.2 measures how bad a flaw could be, not how many hackers are actually using it right now. Those are two different questions. The Cybersecurity and Infrastructure Security Agency (CISA) keeps a separate list, called the Known Exploited Vulnerabilities catalog, just to track which bugs are confirmed to be under real attack. A flaw can carry a dangerous score without yet appearing on that list, and the absence of a listing doesn’t mean the risk is overstated.

That distinction matters here. The flaws are rated as severe as they come, and Cloudflare has already seen probing attempts. But the full scope of actual break-ins tied to PHP2Shell is still being measured, a process that typically plays out over days and weeks after a patch ships. For now, the clearest fact is simple: millions of PHP-powered sites needed an update, and the clock on doing it safely started the moment the flaws became public.

🚨 OCTOBER 21, 2026: PHP JUST HAD ITS WAKE-UP CALL.

Two critical vulnerabilities.

Emergency security releases.

The possibility of unauthenticated remote code execution.

And website operators worldwide scrambling to secure their infrastructure.

Today, the PHP project released… pic.twitter.com/TBDz3o5ypY

— TheGuyWhoKnows // UpHonestRealEstate (@UpHonestReal) October 22, 2026

Website owners running PHP are being told to check their version numbers now and update without delay, since the fix is the only confirmed protection against both flaws.