Two critical vulnerabilities in PHP, one of the internet’s most widely used programming languages, are threatening web applications worldwide, Germany’s Federal Office for Information Security (BSI) has warned, raising concerns about potential attacks on websites, servers and sensitive data.
“Critical vulnerabilities within the PHP programming language are currently threatening web applications worldwide,” the BSI said. PHP underpins a substantial proportion of the internet, including personal blogs, major news portals, online shops and content management systems such as WordPress.
Experts estimate that between 400 million and 500 million websites worldwide run on WordPress alone. Other widely used platforms built on PHP include Moodle, Joomla!, Typo3 and Drupal, extending the potential reach of the security flaws across different types of websites and online services.
The BSI has classified the threat at level “3 / Orange”, describing the risk as exceptionally high. It said immediate action was necessary to prevent major disruption to normal operations and warned that the vulnerabilities had significant potential to compromise computer systems across a wide range of applications.
“Knowledge of vulnerabilities of this kind could enable attackers to carry out massive attack campaigns and compromise IT systems across a wide variety of application areas,” the agency said.
The vulnerabilities, known collectively among security experts as “PHP2Shell”, have been registered under the identifiers CVE-2026-109618 and CVE-2026-109619. According to the source, attackers could exploit the flaws to execute malicious code remotely on affected servers without first logging in.
Such remote code execution could allow attackers to take control of websites, access sensitive databases and customer information, or use compromised infrastructure to conduct further cyberattacks. The BSI said it could not currently rule out the possibility that the vulnerabilities would enable malicious code to be executed remotely on web servers running PHP applications.
Thomas Caspers, vice-president of the BSI, warned that the period immediately after security updates became available could be particularly dangerous. The agency expected widespread exploitation to begin within hours of the patches being released.
“We expect widespread exploitation in the short term, within hours of the security updates becoming available,” Caspers said. He added that attackers could use artificial intelligence-assisted tools to analyse the vulnerabilities quickly and generate corresponding exploits.
The BSI urged administrators to install security updates immediately wherever possible. If patches could not be applied at short notice, it said temporarily disconnecting affected web servers from the internet could be considered to reduce the risk of compromise until the necessary fixes were available.
The developers of the PHP project announced that a security patch would be released on Wednesday afternoon at 16:00 and called on users to install all available updates. The project also outlined alternative measures for addressing the vulnerabilities.
The warning has already prompted some institutions to restrict access to their online services. Municipal authorities, government agencies, universities and hospitals have temporarily taken websites offline following the BSI’s recommendation, seeking to reduce their exposure to potential attacks.
For internet users who do not operate websites, the warning does not initially require any direct action during ordinary browsing. However, they could still be indirectly affected if attackers exploit the vulnerabilities to steal personal information held by compromised websites.
Felix Kuhlenkamp, head of security at Germany’s digital industry association Bitkom, said the vulnerabilities were serious because PHP was used globally across online shops, corporate websites and government portals.
Dane Knecht, chief technology officer at cybersecurity company Cloudflare, warned on X that attackers had already begun exploiting the flaws. Users on the platform were also sharing preliminary quick fixes intended to provide websites with at least partial protection.
