October 21, 2026, 4:02 pm | Read time: 2 minutes
A critical security flaw in PHP could endanger countless websites and online services worldwide. Attackers could take over vulnerable servers and steal sensitive data.
PHP2Shell Makes Servers Vulnerable
Behind the threat known as “PHP2Shell” are two vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. The issue is particularly serious because PHP is used on numerous websites. Through these security gaps, cybercriminals could remotely execute their own malicious code on vulnerable servers, thereby gaining control over the systems.
This could lead to various attacks: Criminals might steal user data, manipulate websites, or use hijacked servers for further attacks. The situation is further exacerbated by the premature public release of information about the vulnerabilities. Experts fear that attackers could automatically search for unprotected servers.
Also of interest: How to Learn Programming
Security Flaw in Windows 11: Researcher Releases Controversial Code
Fake Captchas Can Install Malware
Authorities Take Websites Offline
The security warning has already had practical consequences. Municipalities, authorities, universities, and hospitals have partially shut down online services as a precaution. This is intended to prevent attackers from exploiting potential vulnerabilities in publicly accessible web servers and accessing other systems from there.
An example is Mainz, where the city portal mainz.de and other online services have been temporarily taken offline. The aim is to minimize impact on normal operations: Offices and citizen service centers remain reachable by phone and email. Previously scheduled appointments are also expected to proceed as planned.
What Website Operators Should Do Now
Website, online shop, and corporate platform operators need to act urgently. Available security updates for PHP and affected systems should be installed as quickly as possible. Those who do not manage their servers themselves should contact the responsible administrator, IT service provider, or hosting provider.
Regular internet users do not need to update their smartphones or computers. The vulnerabilities affect the servers on which websites run. However, consumers can be indirectly affected. Possible impacts include temporary outages of online services. If unprotected servers are successfully attacked, data stored there could fall into the hands of cybercriminals.