Most of the internet is suddenly melting down, and there's only one fix

Two newly disclosed PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619—have been leaked online and are being described as a high-impact risk across the web. Security firm Huntress and watchTowr confirmed the leak’s authenticity. The paired flaws, dubbed “php2shell,” are remote code execution issues, meaning attackers can send malicious commands to a PHP server without needing a password or login. The article notes PHP powers roughly 69%–79% of websites, including major services such as Microsoft, American Express and Verizon. The NSA Cybersecurity team urged organizations using PHP to prepare immediate updates; if updates aren’t feasible, it recommends taking affected systems offline until fully mitigated. For users, the article says they can continue logging into the same sites.