Security · October 27, 2026
Also published in Português (Brasil)
Critical PHP Security Vulnerability Discovered
A critical cybersecurity vulnerability named PHP2Shell has been identified within the core engine of PHP (Hypertext Preprocessor), impacting numerous internet services. This discovery marks a significant moment in the global cybersecurity landscape, with the vulnerability reportedly hidden for over a decade.
Advanced artificial intelligence (AI) technology has successfully detected this critical security gap, which is categorized with a severity score of 9.2 out of 10. The vulnerability is listed under the identifiers CVE-2026-109618 and CVE-2026-109619.
According to cybersecurity expert Alfons Tanujaya, the PHP2Shell vulnerability allows hackers to gain full control over servers through Remote Code Execution (RCE). Alarmingly, attackers do not require any access rights, usernames, or passwords to breach the system, posing a serious risk to organizations relying on PHP.
The PHP language supports approximately 70 percent of websites globally, which includes online stores, news portals, and government services. The presence of outdated PHP versions, particularly versions 5 and 7, within internal networks increases vulnerability, as many institutions hesitate to update due to operational stability concerns.
Tanujaya likens a public website to a public service building, where PHP functions as the main data processing hub. The PHP2Shell vulnerabilities enable hackers to exploit the system through two deadly phases of exploitation. He emphasizes that attackers can swiftly seize control of the main server by triggering an error from outside the website, potentially in mere seconds.
The risks extend beyond external threats; internal vulnerabilities also exist from within networks. Devices infected with malware or compromised employee laptops can pose significant risks when connected to the intranet. When the details of these vulnerabilities become widely available, hackers can create automated attack scripts in just minutes, whereas network administrators may take weeks or even months to update outdated PHP versions.
As a precautionary measure, Tanujaya suggests that temporarily taking down servers or public services is a rational emergency mitigation step. He argues that halting services is far safer than allowing critical systems to be infiltrated or completely controlled by unauthorized individuals.