PHP is ‘the web itself’
PHP is a widely-used, open source server-side scripting language that underlies websites like WordPress, which powers 43% of the web, as well as Mailchimp, Drupal, Magento, Laravel, and parts of Slack and Zoom, and numerous others.
The impact is not limited to websites, noted the Netherlands National Cyber Security Centre (NCSC-NL) in its description of the flaws, collectively dubbed PHP2Shell. PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly. And CERT-EU, an organization that tracks cybersecurity threats in the European Union, also warned that many commercial and open-source products use PHP as a backend technology, and these could be also impacted by the flaws, even if they do not directly expose a PHP installation.
This makes the vulnerabilities all the more serious. CVE-2026-109618, which has a 9.2 severity rating on the common vulnerability and scoring system (CVSS), could allow RCE via memory corruption during out-of-memory handling (OOM), a strategy that operating systems (OSes) and apps use when physical RAM and swap spaces become exhausted.
