This is PHP2Shell, the flaw that threatens seven out of ten websites

Recent vulnerabilities in PHP, affecting around 70% of websites, allow attackers to execute code on servers without authentication. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, exploit memory management issues during request processing. Despite the challenges in exploiting these vulnerabilities, their severity is rated 9.2 on the CVSS scale. The discovery was expedited by AI tools, enabling researchers to identify issues faster than traditional methods. PHP released patches, but many websites may not update promptly, leaving them at risk. Cloudflare reported early attack attempts before the patches were available, highlighting the urgency of the situation.