Two critical security vulnerabilities in PHP, the scripting language powering a vast number of websites and web applications globally, have prompted urgent warnings from cybersecurity agencies. Experts are advising organizations to immediately install security updates to mitigate potential risks.
Understanding the Critical PHP Vulnerabilities
Identified as CVE-2026-109618 and CVE-2026-109619, these flaws, collectively dubbed "php2shell," could allow attackers to execute malicious code on vulnerable servers without needing to log in or obtain prior authentication. Both vulnerabilities have been assigned a critical severity score of 9.2 on the Common Vulnerability Scoring System (CVSS) version 4.0. The PHP development team released security fixes on October 21, 2026.
These vulnerabilities are particularly concerning because they affect PHP's core runtime, not just a specific website, plugin, or application. This means that websites and services using vulnerable PHP versions are at risk even if their own application code is flawless. India's Computer Emergency Response Team (CERT-In) has also issued a critical alert, urging affected users and organizations to apply the necessary security updates.
What is PHP and Why is it Important?
PHP is an open-source, server-side scripting language widely utilized for building dynamic websites and web applications. It plays a crucial role in processing user requests, communicating with databases, managing user logins, and displaying content that adapts to user activity. PHP supports widely used platforms and content management systems like WordPress, Drupal, and Joomla, and can operate across various server configurations.
Because PHP operates on the server, a severe vulnerability in its underlying engine can compromise more than just a website's displayed content. If attackers gain the ability to execute code on the server, they could potentially compromise applications, access sensitive information, or disrupt services, depending on the system's configuration and available privileges.
Details of the Two Flaws
The "php2shell" flaws concern how PHP manages memory and its internal program state during request processing:
- CVE-2026-109618 (Out-of-memory corruption): This vulnerability arises when PHP encounters a memory shortage during request processing and fails to handle the interruption safely. Under specific conditions, PHP might interrupt processing before its internal data is fully initialized. During subsequent cleanup, the software could mistakenly treat invalid or partially initialized memory as valid, potentially allowing an attacker to execute malicious code remotely.
- CVE-2026-109619 (Stale global state): This second vulnerability relates to internal data PHP uses while handling requests. In certain scenarios, PHP may retain a reference to memory that has already been freed. A subsequent request handled by the same worker process might then encounter this outdated internal state before it has been properly reset. This can lead to PHP accessing invalid memory and potentially enable an attacker to execute malicious code.
While the two vulnerabilities involve different memory-management failures, their potential outcome is similar: an attacker could gain the ability to run code on an affected server without authentication.
Affected Versions and Severity
These vulnerabilities impact multiple PHP versions, including older releases. The PHP project has issued fixes for four supported release branches. PHP 8.1 and older versions are also affected but no longer receive direct security updates from the PHP project. Organizations should verify the security status of their installed packages with their hosting provider or software vendor, rather than relying solely on the version number displayed by a system.
The Threat of Remote Code Execution (RCE)
The primary concern is that these vulnerabilities enable Remote Code Execution (RCE) without requiring prior authentication. RCE allows an attacker to compel a vulnerable system to run arbitrary commands or code. The consequences of successful exploitation can be severe:
- Website Compromise: Attackers could alter website content, redirect visitors, or inject malicious scripts.
- Data Theft: Sensitive information accessible to the compromised process, including customer records and credentials, could be exposed.
- Server Takeover: Attackers might establish persistence, deploy additional malware, or use the compromised server to attack other systems.
- Service Disruption: A compromised server could be damaged, misused, or rendered unavailable.
It's important to note that these are potential consequences, not a confirmation that every vulnerable website has been compromised.
What Organizations and Website Owners Must Do
The immediate priority is to identify vulnerable PHP installations and apply the relevant security fixes.
- Update PHP Immediately: Install the appropriate fixed release or a security update provided by your operating system or hosting vendor.
- Prioritize Internet-Facing Systems: Publicly accessible servers and applications should receive immediate attention, especially where PHP processes requests from untrusted sources.
- Check Third-Party Software: Review content management systems, hosting environments, containers, and other products that may bundle or depend on PHP.
- Review Security Logs: Look for unusual processes, unexpected files, suspicious outbound connections, and abnormal web server or application activity. Patching alone does not confirm whether a system was previously compromised.
- Isolate Systems if Necessary: If a vulnerable internet-facing system cannot be patched promptly, assess whether temporary isolation from public networks is required until remediation is possible.
Security agencies emphasize that updating to a fixed release is the complete remediation. Organizations should not assume that a web application firewall or other temporary defensive measures are adequate substitutes for patching.
Global Response to the Threat
The cybersecurity community has reacted swiftly:
- Europe: The European Commission, ENISA, CERT-EU, and Europol's European Cybercrime Centre issued a joint warning. Public-facing government and institutional websites in the Netherlands were taken offline as a precaution. Finland suspended some public network services, and France's Interior Ministry placed its websites under preventive maintenance.
- United States: The US National Security Agency (NSA) warned that PHP's widespread use could create opportunities for malicious cyber actors. Security researchers also reported attempts to exploit the vulnerabilities before and around public disclosure.
- India: India's Computer Emergency Response Team (CERT-In) published vulnerability note CIVN-2026-0510, classifying the issue as critical and advising immediate updates.
- Japan: Prime Minister Sanae Takaichi urged website owners via X to check their sites and prepare to apply fixes.
- Technology Companies: Cloudflare announced protective measures through its web application firewall, while Google Cloud published guidance. Cybersecurity firms like Wiz, Qualys, and Palo Alto Networks released technical assessments.
- Major Online Services: Reuters reported that Wikipedia and the Internet Archive temporarily took some systems offline while addressing the security issue.