Key Takeaways
- Two serious security flaws in PHP could affect 1.3 million internet-connected systems.
- Attackers could exploit the vulnerabilities to run malicious code on web servers.
- Administrators are urged to prepare for updates and monitor official announcements.
Two critical security flaws in PHP have raised concerns among website administrators, potentially putting millions of websites at risk of hacking. Security experts warn that attackers may launch widespread attacks within minutes of fixes becoming available.
PHP, a widely used programming language, powers numerous website-building platforms and internal tools, including WordPress. According to a security researcher, approximately 1.3 million internet-connected systems could be affected by these vulnerabilities.
The severity of the flaws, rated 9.2 out of 10, means that if exploited, vulnerable systems could face serious security issues. The widespread use of PHP across the internet makes these vulnerabilities a significant concern for website operators.
Security firms such as Sansec, Wordfence, and Huntress have urged administrators to prepare for the updates immediately. They recommend identifying who is responsible for updating PHP, checking which websites and applications use it, and preparing a maintenance window starting at 14:00 UTC.
Administrators should be ready to install the security updates as soon as they become available. Security experts advise backing up website and database files and monitoring PHP.net for announcements. Some have even suggested temporarily taking nonessential systems offline until they can be updated.
The warning follows reports that unconfirmed details about the vulnerabilities were leaked online. The leaked material reportedly included a video demonstrating an exploit tool called PHP2Shell, which can run code on web servers. The demonstration allegedly showed the tool working against several popular platforms, including WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9.
Security company watchTowr confirmed that both vulnerabilities are real and are tracked as CVE-2026-109618 and CVE-2026-109619. PHP maintainers stated that the patches could be released earlier than planned if details of the flaws become public or attackers start exploiting them.
The post Millions of Websites Could Be at Hacking Risk From Dangerous PHP Flaws appeared first on ProPakistani.
