A global internet vulnerability has been discovered, affecting approximately 80% of all websites and making them vulnerable to cyber attacks and data breaches.
What happened
Two PHP vulnerabilities, dubbed CVE-2026-109618 and CVE-2026-109619, were leaked online, allowing hackers to potentially commandeer websites, steal sensitive user data, and deploy ransomware. The vulnerabilities, known as php2shell, affect PHP version 5 and up, which powers around 69-79% of websites, including those of tech giants and financial services.
The NSA Cybersecurity team has issued a warning, advising organizations using PHP to update their systems immediately to address the critical vulnerabilities. The update involves patching to PHP version 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the site's current PHP iteration.
As a result, many websites may undergo system updates, potentially leading to temporary downtime or limited features. Users are advised to access websites directly and avoid clicking on secondary links in messages or emails to minimize the risk of cyber attacks.
