Two critical PHP bugs nearly broke the internet, say experts

Two critical flaws in PHP, the web programming language used by most of the internet, sparked a major security scare this week. Dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, the bugs let attackers break into websites or servers running PHP and access or modify data without a password. Experts warn it is unlikely to be the last such scare.