Global Websites Hit by Critical PHP2Shell Flaw – What You Need to Know

Earlier this week, India’s national computer‑security outfit, CERT‑In, released a stark warning about two brand‑new vulnerabilities in PHP – the scripting language that powers everything from personal blogs to massive e‑commerce platforms. The bugs, collectively called “PHP2Shell”, are being treated as critical, and they have already caused a handful of public sites around the world to go dark.

What exactly is PHP2Shell? In plain English, it’s two separate flaws (CVE‑2026‑109618 and CVE‑2026‑109619) that allow a remote attacker to inject and execute arbitrary code on a server that runs an unpatched version of PHP. The European Union’s CERT‑EU gave the issues a severity score of 9.2 out of 10 – basically “run‑away train” level. The scary part is that the attack works without any password or authentication; if the server uses the common mod_php configuration, the malicious payload can trigger before the website’s own code even gets a chance to run.

Because PHP is the engine behind WordPress, Drupal, Joomla, Magento and countless custom‑built portals, the ripple effect is huge. Within hours of the advisory, Finland temporarily disabled its public government web services, the Netherlands pulled down the sites of its cybersecurity agency, a public‑health body and the lower house of parliament, and the Wikimedia Foundation shut down a few of its backend systems, making parts of Wikipedia inaccessible for a short spell.

So, what does this mean for the average internet user? If you’re just browsing, there isn’t much you can do to patch the flaw yourself – the responsibility lies with the site owners. However, a compromised site can become a conduit for phishing, data leakage or ransomware distribution. In the coming days, keep an eye out for any unexpected “update your password” emails, avoid entering credit‑card details on sites you don’t fully trust, and, as a good habit, use unique passwords for different services.

Website owners, developers and hosting providers need to act fast. PHP released patched versions on the same day CERT‑In issued its advisory (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). If you’re running a site on any of those branches, verify that the update has been applied – a quick check with your hosting support should suffice. Older branches (PHP 8.1 and earlier) are no longer receiving official fixes, so the safest route is to upgrade to a supported version or, if that’s not possible immediately, consider taking the server offline until it can be patched, as advised by the UK’s National Cyber Security Centre.

In short, the PHP2Shell flaw is a reminder that even the most ubiquitous, “tried‑and‑true” technologies can harbour hidden dangers. Stay vigilant, keep your software up to date, and don’t panic – the security community is already rolling out fixes and mitigation guides. The internet will be back to normal once the patches are widely deployed.