PHP-ocalypse: How two critical web bugs almost broke the internet
- ID
- 39053
- Status
- summarized
- Published
- 24 Oct 2026, 11:30 PM
- Fetched
- 24 Oct 2026, 11:34 PM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 7.5
- Created
- 24 Oct 2026, 11:35 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, let attackers access or modify data on PHP servers without a password, and the PHP Foundation released patches on Wednesday after giving major hosts early access. Banks, retailers, gaming sites, hospitals, and some government agencies took servers offline to patch, while researchers warn many systems remain unpatched and vulnerable.
Why it matters
If you run PHP, WordPress, or a PHP-based SaaS/website, this is a patch-now incident: confirm your host applied the PHP Foundation fix or take the service offline until you can. Founders should also check third-party vendors and agencies that host their sites, because the article says major institutions pulled services offline and many systems remain exposed.
Discussion angle
How should small teams verify a 'patch now' runtime CVE when they rely on managed hosting or agencies—what evidence do you demand that PHP was patched, and what is your fallback if it was not?