Two Dangerous Vulnerabilities in 'PHP' Language Threaten Websites Worldwide
Two critical vulnerabilities in the PHP language, which allow server takeover, have prompted Germany and Kuwait to take urgent preventive measures.
Translated by Qiyas from الجريدة — Original source
The vulnerability affects the widely used PHP programming language, which underpins a large portion of the internet, ranging from simple blogs and major news portals to complex e-commerce stores and content management systems such as WordPress.
According to multiple sources, including Huntress, an information security firm, the German government’s Computer Emergency Response Team (CERT), and the official PHP security team, the situation constitutes a critical emergency requiring swift action from website operators worldwide.
Cybersecurity experts, under the designation “PHP2Shell,” have warned of two critical vulnerabilities at the core of the programming language, officially registered under identifiers CVE-2026-109618 and CVE-2026-109619. The potential risks associated with these flaws are classified as extremely high, as attackers could exploit them to remotely execute malicious software on affected servers.
In practical terms, this allows attackers to gain full control over websites, steal sensitive customer data, or leverage the infrastructure to carry out other cyberattacks.
Due to the accidental premature disclosure of detailed information about the vulnerability, the global information technology industry as a whole is facing significant time pressure. Sector experts fear that criminals may soon resort to using automated scripts to scan for unprotected servers on the internet and launch widespread attacks.
The scale of this acute threat is already becoming evident in public life; several municipalities, government agencies, universities, and hospitals in Germany have begun responding to security authorities’ warnings by temporarily suspending their services and websites to protect them and counter potential attacks.
For its part, Kuwait’s Central Information Technology Authority (CITA) has issued an advisory bulletin regarding security vulnerabilities in the PHP programming language.
The authority emphasized the necessity of taking appropriate measures and applying security updates recommended by the developer as soon as possible, alongside reviewing affected systems and applications, and regularly monitoring security bulletins issued by the developer.
