PHP Nightmare: How to defend your critical system

This week, tension has been high in the cybersecurity world following the discovery of a serious vulnerability that can render web servers inoperable, disrupt networks, collapse critical systems, and expose organizations to significant risk. The issue lies in PHP, which stands for Hypertext Preprocessor. Several newly identified flaws in PHP are now being recognized as a global threat to web servers.

As reported by the National Security Cybersecurity Center,  the scale of these cybersecurity flaws has now reached millions of websites around the world at an unprecedented height. Just a single flaw in PHP opens the same door on millions of servers at once. Whoever exploits the flaw controls the website. There are two critical vulnerabilities known for PHP affecting web servers, which have now become php2shell. Among these widely shared reports by PHP, Calif and Wiz Research disclosed a few days ago, there are two critical vulnerabilities in the core PHP language runtime that can expose applications to unauthenticated remote code execution and memory disclosure. 

The impact

According to Cloudflare, which is used by millions of websites to protect against cyber attacks, nearly 70 per cent of all websites were impacted. Given PHP’s widespread use across websites, the PHP2Shell vulnerabilities raise serious security concerns for organisations hosting vulnerable PHP applications, potentially exposing sensitive systems and data to remote code execution. This means that all users running any version of PHP are affected, and all organisations are highly encouraged to update to the latest fixed version. Major business giants, like Amazon, government websites, cloud services operators, Drupal, and businesses using PHP behind the scenes are mostly exposed to these flaws, giving attackers pinpoint targets to easily cause harm. In fact, many of these organisations now scramble to temporarily take their system offline as their workers rush to install security patches. Others move permanently offline. 

What exactly is PHP and its vulnerability flaws? 

PHP, which is otherwise known as  Hypertext Preprocessor, is an open-source, server-side programming language used to build websites and web applications. Organisations and enterprises largely use php and server-side scripting language that power many websites, content management systems and web applications. On Oct. 21, 2026, CVE.org assigned the vulnerabilities as CVE-2026-109618 and CVE-2026-109619.

A vulnerability is a critical security flaw found in a system. To help analysts prioritize, flaws are graded using the Common Vulnerability Scoring System (CVSS). According to Datadog, each of the PHP flaws has received an official CVSS base severity score of 9.2, which is classified as critical. This rating means threat actors could potentially crash and hijack the affected system and easily steal, alter, or wipe its data, although mitigating factors may make exploitation more difficult in practice.

CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup may then treat the invalid data as valid.

CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

How to detect if you are affected? 

Based on research, any PHP runtime that serves HTTP requests is in scope. Recently,  PHP’s release announcement warned that all web deployments are affected, including Apache modules, PHP FastCGI Process Manager (PHP-FPM), php-cgi, FrankenPHP, and LiteSpeed.

Building your inventory must include containers and applications that bundle their own PHP interpreter. Organizations should not rely solely on the command-line PHP installation: it can use a different version or configuration than the runtime that serves your web application.

Fixed versions

The advisories for both CVE-2026-109618 and CVE-2026-109619 list the same fixed versions for each supported branch:

Mitigation and Remediation: How to Protect PHP Applications Against PHP2Shell

As indicated below, developers can set this in their PHP configuration: CVE-2026-115560 could allow attackers to execute code on a server, but only when an application uses an unusual combination of PHP session settings. Most applications are unlikely to be affected if properly configured.

Developers can set this in their PHP configuration: “session.upload_progress.enabled=0.”

The advice is not entirely new. PHP had already recommended the same mitigation in an October 21st advisory covering CVE-2026-109619, one of a pair of critical vulnerabilities involved in the recent PHP2Shell security incident.

According to the PHP Foundation report, developers who have already applied the setting do not need to take further action for this newly identified issue.

What Should be Done?

According to the National Security Agency/Central Security Service, this coming week, the Organization should be critical and prioritize maintaining heightened awareness of its internet-facing devices and services that are mostly hosted on PHP. It is important for all to prioritize incorporating vendor patches that may be explicitly tied to the PHP2Shell issues. All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions. Vigilance in applying patches related to those systems is paramount. 

PHP released its open-source software patch on Wednesday, October 21, 2026. Additional software vendors may also publish patches once they are available. It’s imperative to closely monitor these updates. CERT-EU strongly recommends updating all affected PHP installations as soon as possible to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 [4].

Reference:

1. https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/ 
2. https://www.nsa.gov/press-room/press-releases-statements/press-release-view/article/4630238/nsa-advisory
3. critical-patches-recommended-for-php-vulnerabilities/ 
4. CERT-EU – Critical Vulnerabilities in PHP 
5. https://www.bbc.com/news/articles/c3qjnwye0ep5o