// KOTAKU — GAMING
The Internet Is Currently On Fire
Over the past 48 hours, multiple security flaws and vulnerabilities have been reported online. While PHP2Shell is still the primary vulnerability that’s got everyone scared, it’s not the only critical bug that was reported in the past two days.
Now, nobody panic! Yes, it’s kinda scary that everything on the internet is breaking at once, but let’s get our ducks in a row before we start unplugging all our electronics and covering our windows with tinfoil. First things first, is it a coincidence that these vulnerabilities have all been reported at the same time, or is there a more sinister explanation for all this? The latter.
I think it’s best to have the experts explain this one, so here are two quotes that I believe put it all into perspective. Firstly, Cloudflare CEO Matthew Prince on X: “In the 10 hours before [the PHP vulnerability] was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Here’s a second quote from Wiz Research, one of the research teams that discovered the PHP vulnerability: “Pre-AI, this manual work would be difficult to implement and even harder to scale[…]This changes the economics of both discovery and exploitation. As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.”
Here’s the dummies guide version: AI has gotten better at detecting vulnerabilities and fixing vulnerabilities. That’s good! But AI has also gotten better at exploiting vulnerabilities, so its improved detection is a double-edged sword. That’s why all these issues are being reported at once, and it’s also why the people reporting them are scared. It might sound a little reductive, but I find it oddly comparable to the Wild West: everyone has a gun now, so we just gotta hope the bad guys have bad aim.
To that end, here’s a roundup of the most pressing “critical” vulnerabilities discovered and reported in the past week. Just keep in mind that there’s a solid chance that in between writing this and hitting publish, more may have been reported.
All right, let’s start with the big one: PHP2Shell. But what is PHP? It used to be an abbreviation for Personal Home Page, but these days it stands for Hypertext Preprocessor. It’s a programming language used to power websites, mobile apps, data apps, and more.
One piece of info that seems to have been partially overlooked online is that PHP2Shell is actually two vulnerabilities in one: CVE-2026-109618 and CVE-2026-109619. However, both vulnerabilities allow for the same exploit, commonly known as RCE (Remote Code Execution).
In simplest terms, RCE allows someone to run code on your machine remotely, and without your permission. An estimated 70 percent of websites across the internet rely on PHP. This is why the United States’ National Security Agency and the UK’s National Cyber Security Centre suggested that websites go dark until the vulnerabilities are patched.