Critical PHP Security Flaws Trigger Global Cybersecurity Alert as Hackers Target Vulnerable Websites

Two critical security vulnerabilities in PHP, one of the internet’s most widely used programming languages, have triggered a global cybersecurity response, prompting government agencies, businesses and technology organisations to temporarily take websites and online services offline while they assess their exposure and apply emergency security updates. The vulnerabilities, collectively referred to as “PHP2Shell” in security advisories, could allow attackers to execute malicious code remotely on vulnerable servers without requiring authentication, potentially exposing sensitive information and enabling further attacks.

The security flaws, identified as CVE-2026-109618 and CVE-2026-109619, were addressed through emergency updates released by the PHP development team on October 21, 2026. Both vulnerabilities carry a critical severity rating of 9.2 on the Common Vulnerability Scoring System (CVSS), reflecting the potential consequences of successful exploitation.

The incident has prompted security agencies and technology providers to urge organisations to identify vulnerable PHP installations, install the relevant patches and isolate internet-facing systems that cannot be secured immediately. Reports of temporary service disruptions have emerged across Europe, Asia and North America, with government portals, public services and commercial websites among those affected by precautionary shutdowns.

Importantly, the incident involves vulnerabilities in the underlying PHP software rather than a single attack against one organisation. The existence of a vulnerable system does not automatically mean it has been compromised, and temporary shutdowns do not necessarily indicate that data has been stolen. However, security researchers have reported attack attempts, increasing the urgency of remediation.

Two Critical Vulnerabilities Could Allow Remote Server Access

PHP is a server-side programming language used to build and operate websites, web applications and content management systems. It supports widely used platforms, including WordPress, Drupal and Joomla, as well as numerous online stores, business applications, hosting services and government websites.

Because PHP processes incoming web requests on servers, vulnerabilities in its core runtime can affect multiple applications running on the same infrastructure. Organisations may therefore face exposure even when their individual website software appears up to date, if the underlying PHP installation remains vulnerable.

The first flaw, CVE-2026-109618, involves how PHP handles out-of-memory errors. Under certain circumstances, an interrupted operation can leave internal request data only partially initialised. Subsequent cleanup processes may then handle that invalid data incorrectly, creating a pathway for memory corruption and potentially remote code execution.

The second flaw, CVE-2026-109619, involves stale internal state that can remain accessible after the memory associated with a request has been released. If a subsequent request handled by the same worker accesses that stale state before it is properly reset, the resulting memory-management failure can potentially be exploited.

Together, the vulnerabilities create risks that extend beyond website availability. Depending on the system configuration and the success of an attack, exploitation could allow an attacker to run unauthorised commands with the privileges of the PHP process, interfere with application operations or access sensitive information held in memory.

That information could include authentication tokens, passwords, API keys and other credentials, depending on what is present in the affected process. Attackers who obtain access to a server may also attempt to move further into connected systems, although such consequences are not inevitable in every case.

The vulnerabilities are particularly concerning because exploitation does not necessarily require a legitimate user account. Security researchers have demonstrated attack paths that can be triggered through unauthenticated requests, making internet-facing PHP services a priority for investigation.

Emergency Patches Released for Supported PHP Versions

The PHP development team released security fixes on October 21 for four supported release branches. Organisations have been advised to apply the appropriate updates immediately and verify that their hosting providers have deployed the necessary patches.

Security advisories identify PHP versions before these patched releases as affected, including versions dating back to PHP 5.4. PHP 8.1 and older branches have reached end of life and no longer receive routine upstream security updates. Organisations using these versions must check whether their operating-system or hosting vendors provide relevant backported fixes and plan migration to supported software.

The affected environments include PHP-FPM, Apache configurations using mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team has identified Apache’s mod_php configuration as particularly high-risk in this incident, although other deployments also require assessment.

For organisations unable to patch immediately, cybersecurity authorities have recommended isolating vulnerable applications from public networks or taking them offline until the fixes have been installed and verified. Firewall rules and other temporary controls may reduce exposure, but they should not be treated as substitutes for installing the security updates.

Hackers Began Testing the Vulnerabilities Before Patches Were Released

The timeline of the incident has added to concerns among security professionals. According to reporting based on Amazon Threat Intelligence findings, the first observed exploitation attempt against a honeypot—a deliberately monitored system designed to detect malicious activity—occurred on October 17, four days before the security updates were released.

Further attempts were detected around the October 21 disclosure and patch release. Amazon reported activity involving different exploit attempts and anonymised network infrastructure, while noting that the source of the early exploit information and whether the attempts would have succeeded against real-world systems remained under investigation.

The early activity is significant because attackers may begin targeting vulnerable systems before organisations have time to apply security fixes. It also demonstrates why the public announcement date should not be assumed to be the beginning of exploitation.

Security researchers have subsequently published technical details and proof-of-concept material describing ways to reproduce the vulnerabilities in controlled environments. As exploit information becomes more widely available, organisations that have not patched exposed systems face an increased risk of automated scanning and attempted exploitation.

However, an attempted attack is not the same as a confirmed compromise. Security teams must examine server logs, endpoint telemetry and other evidence to establish whether an attack succeeded, rather than assuming that every vulnerable website has been breached.

Government Websites and Online Services Temporarily Taken Offline

The vulnerabilities have triggered precautionary shutdowns and service restrictions in several countries. Authorities and organisations have prioritised applying patches and checking systems before restoring normal access.

In Europe, government websites and public services in countries including Germany, France, Belgium, the Netherlands, Finland and the Czech Republic experienced temporary disruptions or shutdowns. Reported affected services included government portals, municipal websites and other public-facing digital infrastructure.

The Netherlands saw organisations take services offline, including the Port of Rotterdam, the Overheid.nl government portal and several other public and private institutions. Finnish authorities also reported precautionary shutdowns, while French authorities temporarily deactivated some local administrative websites as security updates were prepared and deployed.

In Japan, several institutions and businesses restricted online services while addressing the vulnerabilities. The affected organisations included major financial, transport and commercial entities. The Wikimedia Foundation also worked to address the risk, while the Internet Archive temporarily suspended its portal before restoring access. Some services operated by the BBC and local authorities in the United Kingdom were also affected by precautionary measures.

Australian government websites experienced disruptions as agencies worked to apply security fixes. Authorities said some services had been taken offline while the risk was addressed. In Canada, officials warned of potential disruption but reported no evidence that government systems or information had been compromised in the context of the initial response.

These measures illustrate the difficult trade-off facing organisations: temporarily interrupting services to reduce the risk of a more serious incident. The shutdowns should not be interpreted as proof that all the affected organisations suffered successful cyberattacks or data breaches.

Artificial Intelligence Played a Role in Discovering the Flaws

The discovery of the PHP vulnerabilities has also highlighted the growing role of artificial intelligence in cybersecurity research. Researchers used AI models and automated testing techniques to identify weaknesses, investigate how they could be exploited and validate potential fixes.

Research teams associated with Calif, working with OpenAI, and cybersecurity company Wiz reported the two vulnerabilities through separate investigations. Wiz researchers used a combination of AI-assisted analysis, exploit development and testing to demonstrate how the flaws could be chained into practical attack paths.

The findings illustrate how AI tools can help security researchers analyse complex software behaviour and test scenarios that may be difficult to investigate manually. At the same time, the same capabilities can lower the effort required for malicious actors to understand vulnerabilities and develop attacks.

The PHP Foundation has acknowledged the seriousness of the incident and the challenges involved in maintaining widely used open-source infrastructure. The flaws reportedly required extensive investigation, and concerns about compatibility, potential denial-of-service effects and changes affecting third-party extensions contributed to the complexity of developing fixes.

The incident has renewed questions about how critical open-source projects are funded, maintained and secured. PHP is maintained by a community of developers, yet it underpins a substantial portion of the internet’s digital infrastructure. Security incidents involving such foundational software can therefore have consequences far beyond the project itself.

Indian Organisations Step Up Security Measures

Indian organisations have also begun responding to the vulnerabilities as part of the wider international cybersecurity effort. Reports published on October 23 indicate that businesses and institutions are accelerating vulnerability assessments, applying patches, reviewing exposed websites and coordinating with technology vendors.

The risk extends across organisations that operate PHP-based websites and applications, including government services, businesses, educational institutions and online platforms. Websites running WordPress or other PHP-based content management systems may also require assessment of their underlying server environments.

For organisations using managed hosting services, the responsibility for applying updates may be shared between the website operator and the hosting provider. Website owners should therefore establish which PHP version their environment uses, whether the hosting provider has installed the fixes and whether any additional action is required for applications or extensions.

Cybersecurity teams are also being encouraged to review logs for unusual requests, unexpected processes, unauthorised file changes and suspicious outbound connections. Where there is evidence of a successful intrusion, patching alone may not be sufficient; affected systems may require incident response, credential rotation and a broader investigation into possible data exposure.

The incident underscores the importance of maintaining an accurate inventory of internet-facing systems, monitoring software vulnerabilities and ensuring that security updates can be deployed quickly when critical flaws emerge.

What Website Owners and Businesses Should Do

Organisations operating PHP-based websites should prioritise the following actions:

• Identify affected systems: Check PHP versions across production servers, staging environments, containers and hosting accounts, including systems managed by external providers.

• Install security updates: Upgrade to the appropriate patched release or confirm that the hosting vendor has applied an equivalent security fix.

• Isolate systems that cannot be patched: Restrict public access to vulnerable services until remediation is complete and verified.

• Investigate possible exploitation: Examine logs and security alerts for suspicious activity, including unexpected file modifications, processes or outbound network connections.

• Protect credentials: If there is evidence of compromise or credential exposure, rotate affected passwords, API keys, tokens and other secrets.

• Verify recovery: Test the application after patching and confirm that all relevant services are running a secured version.

These measures are particularly important for businesses that depend on websites for payments, customer accounts, online transactions or the delivery of essential services. A successful attack could affect not only the website itself but also connected systems and the sensitive information they handle.

A Wider Warning for Internet Infrastructure

The PHP2Shell incident demonstrates how vulnerabilities in widely deployed foundational software can create simultaneous risks for organisations across industries and countries. The possibility of unauthenticated remote code execution, combined with the emergence of public exploit research and reports of early attack attempts, has made rapid remediation a priority.

The response has also exposed the challenges involved in securing open-source infrastructure that supports millions of websites. Even when fixes are available, organisations must identify every affected installation, coordinate with vendors, test updates and ensure that older systems are not left exposed.

For now, the immediate priority is to patch vulnerable installations, verify the security of exposed services and investigate any signs of successful exploitation. The extent of confirmed compromise will depend on evidence gathered from individual systems; the global disruption alone does not establish that every affected website has suffered a breach.

Disclaimer: This report has been editorially prepared using publicly available information and official cybersecurity advisories. Readers are advised to refer to official security announcements for further details.