Critical PHP flaws put pharmacy and retail websites on alert

NEW YORK — Pharmacy retailers and other businesses are being urged to update their web infrastructure immediately after the disclosure of two critical vulnerabilities affecting PHP, the technology that underpins widely used website platforms, including WordPress.

The vulnerabilities, collectively known as PHP2Shell, could let an unauthenticated attacker execute code on an affected web server, potentially giving them control of websites and access to sensitive information stored in server memory.

The PHP development team classified the vulnerabilities CVE-2026-109618 and CVE-2026-109619 as critical and urged users to update immediately. PHP said all installations serving web requests should be considered at risk and that updating is the only complete solution.

The threat has implications for pharmacy retailers and other health care businesses that increasingly rely on websites and digital platforms to connect with customers and patients. PHP underpins a broad range of customer-facing web applications and content management systems, including WordPress, Drupal, and Joomla.

Unlike a vulnerability in a website application or plug-in, PHP2Shell resides in PHP itself. That means businesses cannot necessarily address the threat simply by updating their content management system or other customer-facing software. Companies that outsource their web infrastructure may depend on hosting, cloud, or technology providers to deploy the necessary updates.

Researchers at the cybersecurity company Wiz demonstrated unauthenticated remote code execution against WordPress, Drupal, and Joomla environments. However, because the vulnerabilities are in PHP rather than in those applications, exploitation does not require a specific content management system.

According to Wiz, a successful attack could also expose information stored in PHP process memory, potentially including passwords, authentication tokens, API keys, and certificates.

PHP released patched versions on Wednesday and urged users to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. PHP versions 8.1 and older no longer receive regular updates from the PHP project, although some vendors provide backported security fixes.

The vulnerabilities also highlight an emerging cybersecurity challenge for retailers and health care businesses: artificial intelligence is accelerating the security race on both sides.

AI tools helped researchers uncover longstanding flaws in PHP's code and turn them into working exploits. Wiz said researchers used frontier AI models during the research, including for vulnerability discovery, exploit development, attack detection, and verification of the eventual patch.

Those same capabilities could lower the technical barriers for attackers seeking to exploit vulnerabilities in organizations that have not yet updated their systems.