Millions of Websites Could Be at Hacking Risk From Dangerous PHP Flaws

Two serious security flaws in PHP could put millions of websites at risk, with security experts warning that attackers may commence launching widespread attacks within minutes of fixes becoming available.

Key points

• Individuals Are Using AI to Produce Smart TVs Faster, Safer, and Ad-Free.
• Security firm watchTowr stated the report asserted that every PHP version from PHP 5, issued in 2004, onward could be affected.
• Administrators should identify who is responsible for updating PHP, check which websites and applications employ it, and prepare a maintenance window starting at 14: 00 UTC.
• PHP maintainers plan to release fixes for both flaws, each rated 9.2 out of 10 for severity.
• Security firm Sansec expects large-scale attacks to commence within 15 minutes of the patches becoming available.

PHP maintainers plan to release fixes for both flaws, each rated 9.2 out of 10 for severity. Administrators should be ready to install the updates as shortly as they are issued.

Individuals Are Using AI to Produce Smart TVs Faster, Safer, and Ad-Free. Why the Flaws Are Highly Dangerous.

PHP is a widely applied programming language that helps websites and web applications work. As well as internal tools employed by businesses, it powers WordPress and plenty of other website-building platforms.

One security researcher estimated that around 1.3 million internet-connected systems could be affected.

If attackers exploit the flaws, vulnerable systems could face serious security challenges. The documented severity and widespread apply of PHP create the vulnerabilities a concern for website operators throughout the internet.

Administrators should monitor official announcements and install the security updates as shortly as they become available. Attackers Could Strike Within Minutes.

Security firm Sansec expects large-scale attacks to commence within 15 minutes of the patches becoming available. Other security firms, including Wordfence and Huntress, have additionally pressed website administrators to prepare now.

Administrators should identify who is responsible for updating PHP, check which websites and applications employ it, and prepare a maintenance window starting at 14: 00 UTC. They should additionally be ready to install the fixes earlier if necessary.

Security experts recommend backing up website and database files and monitoring PHP.net for announcements. Some have even suggested temporarily taking nonessential systems offline until they can be updated. Rogue AI Agents Broke Into Indian Firms Without Detection. Leaked Demo Raises Alarm.

For context, the warning follows reports that unconfirmed details regarding the vulnerabilities were leaked online. The leaked material reportedly included a video demonstrating an exploit tool called PHP2Shell. It can run code on web servers.

For context, the demonstration allegedly indicated the tool working against a number of popular platforms, including WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9.

All these platforms employ PHP. Nevertheless, the original leaked report could not be located, and its claims have not been officially confirmed.

Security firm watchTowr stated the report asserted that every PHP version from PHP 5, issued in 2004, onward could be affected. According to The firm additionally noted it had, both vulnerabilities are real. They are tracked as CVE-2026-109618 and CVE-2026-109619.

PHP maintainers remarked the patches could be issued earlier than planned if details of the flaws become public or attackers start exploiting them. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover. Follow on Google News Join WhatsApp. See more ProPakistani stories in Google Search and Top Stories.

Technology and Automotive Specialist covering the latest cars, smartphones, AI breakthroughs, and.

Taken together, the developments around millions of Websites Could Be at Hacking Risk From Dangerous PHP Flaws point to a situation that is still moving, and the coming days should bring more clarity.