On October 21, 2026, PHP, a widely used server-side programming language globally, was found to have two critical security vulnerabilities (CVE-2026-109618, CVE-2026-109619), collectively known as 'PHP2Shell.' Attackers can exploit these vulnerabilities to execute remote code without authentication, potentially leading to website tampering, sensitive information leaks, and even server compromise. Following the disclosure of the vulnerabilities, hacker attack attempts surged to millions, increasing the risk of some systems being breached. Over 30 government services in the UK were temporarily taken offline, and telecommunications operator Orange suspended access to some websites and applications. Government agencies and enterprises in multiple countries have taken emergency measures, including temporarily taking websites offline and shutting down public network services. The PHP development team released a patched version and urged users to update immediately. Security vendors such as 360 provided vulnerability reproduction, repair recommendations, and security checkup services to assist enterprises in risk assessment.