“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are critical vulnerabilities with a CVSS score of 9.2 affecting 70% of websites running PHP-based systems like WordPress. Security researchers, including Ox Security and Censys, report that remediation efforts remain sluggish despite the severity, with 93.6% of systems still unpatched as of five days post-disclosure and approximately 11.2 million Internet-facing PHP services remaining vulnerable. The gap between security awareness and actual patching poses significant risk.
Key points
- CVSS 9.2 severity affecting ~70% of websites with PHP
- 93.6% of systems still unpatched five days after disclosure
- ~11.2 million Internet-facing PHP services remain vulnerable
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The New Stack did the reporting; read the original for the full story.
Read the full story at The New Stack
