Critical PHP Vulnerabilities Discovered, Threatening 70% of Websites

Two critical vulnerabilities, dubbed 'PHP2Shell' (CVE-2026-109618 and CVE-2026-109619), have been found in PHP, allowing unauthenticated remote code execution on vulnerable web servers. These flaws impact an estimated 70% of global websites, including major platforms like WordPress and Drupal, prompting urgent patching advisories from cybersecurity agencies. The discovery, partly aided by AI, highlights evolving challenges in digital security and has led some government sites to temporarily go offline.