Nick Woodhead, a chief technology officer, went 48 hours without sleep patching his company’s systems against a pair of critical PHP vulnerabilities that security researchers have described as one of the most impactful issues of its kind in recent memory.
The vulnerabilities, dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP versions 5.4 through 8.5 and allow remote code execution, meaning attackers who successfully exploit them can steal sensitive data such as passwords or take full control of affected servers.
PHP powers an estimated 70% of websites worldwide, making the scope of the flaw unusually broad, with the bugs reportedly uncovered with the help of OpenAI’s technology, which the company called one of the most impactful security issues of its kind in recent memory.
After a potential attack exploiting the flaws emerged, governments and companies around the world, including dozens of websites in the US and UK, briefly took their sites offline to apply emergency patches rather than risk running unprotected systems.
PHP's development team issued emergency patches once the critical nature of the flaws became clear, with security experts urging site owners who could not immediately patch to simply pull affected systems offline until the fix could be applied.
Woodhead's experience captures the human cost behind headline vulnerability disclosures: for engineering teams at organizations running PHP-based infrastructure, a bug affecting a majority of the internet translated into an immediate, all-hands scramble to patch systems before attackers could exploit the window of exposure.
