ATAILA Newsroom · Budapest ·
2026-W44
PHP vulnerability exposes 70% of the web
On 27 October 2026, reports emerged of two critical vulnerabilities in the PHP programming language, affecting 70% of the internet. The flaws, rated 9.2 in severity, allow remote attackers to execute arbitrary code on affected servers. This is not a theoretical risk; active exploitation was confirmed within hours of disclosure.
The article we are responding to
hvg.hu, 27 October 2026
What happened
On 27 October 2026, two critical vulnerabilities were disclosed in the PHP programming language, the runtime environment that powers approximately 70% of the web. The flaws, collectively referred to as 'PHP2Shell', carry a severity rating of 9.2 on the CVSS scale. Unlike vulnerabilities in specific content management systems, these issues reside in the core runtime itself, meaning they affect a vast array of custom applications and frameworks, not just standard platforms like WordPress.
The nature of the flaw allows a remote attacker to execute arbitrary code on the server, effectively taking full control of the system. Reports indicate that active exploitation began almost immediately after the details became public. Government websites and enterprise portals relying on standard PHP configurations were among the first to be targeted, forcing emergency shutdowns and patching operations.
70 százalék
of the internet is affected by the PHP vulnerability
9.2-es
severity rating on a scale of 10 for both vulnerabilities
2026. október 27.
date the vulnerabilities were publicly disclosed and active exploitation confirmed
What this means for a European company
This incident illustrates the systemic risk of relying on shared, opaque infrastructure. When a fundamental layer like the PHP runtime is compromised, the surface area for attack is massive. For European businesses, the lesson extends beyond patching schedules. It reinforces the argument for infrastructure where the runtime environment is fully visible, controllable, and isolated. In a public cloud or a shared hosting environment, you depend on the provider's speed of response. In a private, sovereign setup, you control the patching window and the isolation boundaries.
What we concede, and what we will be asked
We cannot prevent vulnerabilities in open-source languages. No vendor, including us, can stop a flaw from being discovered in PHP itself. What we concede is that if you run PHP, you are exposed when a flaw like this emerges.
What we will be asked is why our infrastructure is safer. The answer lies in isolation and control. In our private, EU-hosted environments, the blast radius of such a vulnerability is contained to your own tenant. You decide when to apply the patch, and you verify the integrity of the runtime before it touches your data. We provide the isolated hardware and the tools to manage the lifecycle, but the decision authority remains with you.
Sources, and what we did not open
The story we are answering: Mit érdemes tudni mindenkinek arról a két kritikus hibáról, ami az internet 70 százalékát veszélyezteti?, hvg.hu, 27 October 2026. Opened and read in full.
We did not open the specific CVE details or the PHP source code repository, as the article summarizes the impact and severity ratings based on initial security advisories. The figure of 70% market share for PHP is widely cited in industry reports (e.g., W3Techs) but was taken verbatim from the HVG article as requested.
The original article
“Mit érdemes tudni mindenkinek arról a két kritikus hibáról, ami az internet 70 százalékát veszélyezteti?”
hvg.hu, 27 October 2026
- Read it live at hvg.hu
- ATAILA archive, captured 28 October 2026
← Back to the Newsroom Press enquiries: contact us