Government websites and public services across Europe went offline this week as organizations responded to two newly disclosed PHP vulnerabilities. Germany took several federal websites offline, France temporarily shut down prefecture sites, Belgium’s foreign ministry disabled its websites, and organizations in the Netherlands pulled public-facing services as a precaution. It wasn’t confined to Europe, with countless other entities and businesses worldwide responding similarly.

They were all waiting for a PHP vulnerability mitigation that didn’t exist yet.

The cause was PHP2Shell: CVE-2026-109618 and CVE-2026-109619. While the community worked quickly and the PHP project released fixes for all community-supported PHP versions on the morning of October 21, the bigger issue remains unresolved: an estimated 40% of PHP users are running unsupported PHP, even as AI has exponentially accelerated CVE discovery.

“What happened this week was different, and it’s the first shot of what promises to be an ongoing battle across the open-source ecosystem.”

I’ve been contributing to open source for more than 20 years; I lead the Laminas Project, I’m the Principal Product Manager for Perforce Zend and OpenLogic, and I currently serve on the Board of the PHP Foundation — which is all to say, I’ve seen more than my fair share of new security threats.

What happened this week was different, and it’s the first shot of what promises to be an ongoing battle across the open-source ecosystem.

CVE-2026-109618 and CVE-2026-109619 , currently referred to as PHP2Shell, present remote code execution (RCE) risks triggered by a combination of out-of-memory (OOM) conditions and PHP’s error handling.

Source link