Informasi penting
Widespread internet outages and 503 errors across Europe are linked to critical vulnerabilities in PHP, an open-source language powering 69.3% of identifiable websites. Security researchers identified two critical flaws, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, which carry a severity rating of 9.2 out of 10.
PHP2Shell affects servers running PHP 5.4 or later, impacting over 1.3 million servers globally. While PHP has released patches for versions 8.2, 8.3, 8.4, and 8.5, widespread adoption is hindered by version fragmentation and reliance on third-party hosting providers. Major entities like the NSA and the UK's NCSC have advised disconnecting unpatchable systems.
The gaming industry has faced significant disruptions due to these security threats. The digital storefront GOG was taken offline preventatively for approximately four hours before returning to service. Additionally, Final Fantasy XIV login servers were temporarily disabled to allow security teams to implement necessary patches.
Administrators are urged to apply patches immediately, conduct full backups of databases and websites, and maintain an inventory of applications dependent on PHP. In cases where immediate patching is not feasible, experts recommend disconnecting non-essential systems from the network until security measures are fully implemented.
