Two PHP vulnerabilities raise concerns, hundreds of websites taken offline

PHP issued an urgent advisory on Tuesday evening about two new vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a severity score of 9.2/10, which can lead to remote code execution on unpatched websites; hundreds of websites went offline on Wednesday. The vulnerabilities are called PHP2Shell, and the EU, the US, Japan and other countries issued warnings, while companies such as Nintendo also took services offline; Cloudflare said it had already seen attacks appear and released temporary mitigations, and watchTowr said it had observed exploitation in the wild, with the exploit tool written with the help of AI. OpenAI said researchers at cybersecurity company Calif discovered the two vulnerabilities two months ago through its Patch the Planet project using its tools, and worked with PHP and other companies to test fixes and coordinate response, but acknowledged that AI can also help attackers exploit vulnerabilities.