MANILA, Philippines — IT and cybersecurity teams are racing to secure websites against two critical vulnerabilities in PHP, the software that helps power millions of websites and online services.
The flaws, known collectively as PHP2Shell, could allow attackers to run malicious code on vulnerable servers without logging in. In some environments, attackers may also access sensitive information held in the server’s memory.
The PHP development team released emergency security updates on October 21. But applying them is only one part of the response. Organizations must identify every affected system, test and install the correct fix, restart the relevant services and check whether attackers gained access before the patch was applied.
For IT teams, the challenge is especially difficult when an organization relies on old software, several hosting providers or applications that cannot easily tolerate downtime.
Two flaws affect PHP itself
PHP is a programming language that runs on web servers. Websites and applications use it to process requests, manage information and deliver dynamic pages.
The two PHP2Shell vulnerabilities affect the PHP runtime itself—the software that executes PHP code. They are not limited to a single website platform or content management system.
The first flaw, CVE-2026-109618, involves how PHP handles an out-of-memory error. Under certain conditions, PHP can interrupt request processing while internal data remains only partly initialized. Cleanup routines may then handle that invalid data in an unsafe way.
The second flaw, CVE-2026-109619, involves stale internal state. PHP may retain a reference to memory after that memory has been released. A later request can encounter the stale reference before PHP resets it properly.
■ Related News
Both flaws can create a path to remote code execution, meaning an attacker could make a vulnerable server run code of the attacker’s choosing. The consequences would depend on the privileges of the affected PHP process and the surrounding system.
PHP rated both vulnerabilities 9.2 out of 10 under version 4.0 of the Common Vulnerability Scoring System. That places them in the critical category.
Which versions have fixes?
On October 21, PHP released updates for four maintained branches.
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Organizations should check the version running on each server and install the appropriate security update. Those using operating-system distributions, managed hosting or commercial control panels should follow the provider’s specific advisory.
Some providers issue security fixes without changing the visible version number. Administrators must therefore confirm that their installed package includes the relevant patch rather than relying on the version string alone.
Older PHP versions present a harder problem. PHP 8.1 and earlier branches no longer receive regular security updates from the upstream PHP project. Some operating-system vendors and specialist support providers offer backported fixes, but coverage varies.
A backport applies a security fix to an older software branch. It can help an organization avoid an immediate migration, but administrators must confirm that the particular package has received the fix.
Where no suitable security update exists, the organization may need to upgrade, restrict access to the affected system or take it offline until it can be secured.
Patching the runtime is not the same as updating a website
A website may use WordPress, Drupal, Joomla or a custom application. These programs can run on PHP, but updating the website application does not necessarily update the PHP runtime beneath it.
The distinction matters because a vulnerable runtime can expose an application even when the application itself has no known flaw.
PHP can run through several configurations, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk and available protections differ between these environments. PHP’s security team has warned that the vulnerabilities affect installations serving web requests and identified Apache mod_php as a particularly exposed configuration.
Organizations must therefore look beyond the main website. PHP may also run on administrative portals, internal applications, staging servers, forgotten subdomains and systems managed by outside contractors.
Shared hosting creates another challenge. A customer may control the website but have no direct access to the server’s PHP installation. In those cases, the hosting provider must apply the fix, and the customer needs confirmation that the affected environment has been updated.
The emergency does not end when the patch is installed
Installing a security update closes the known vulnerability in the patched software. It does not prove that an attacker failed to exploit the earlier version.
That distinction makes incident checks an important part of the response. Organizations need to establish which systems were exposed, how long they remained vulnerable and whether suspicious activity occurred during that period.
Amazon’s threat-intelligence team reported an attempted PHP2Shell exploit against a honeypot on October 17—four days before the public release of the vulnerabilities. A honeypot is a system designed to attract and record suspicious activity.
Amazon also recorded further attempts around the public disclosure on October 21. The company said the activity appeared to involve multiple sources, but it could not establish whether every attempt would have succeeded against a real system.
These findings show why defenders cannot assume that the public patch date marks the beginning of the risk. They do not, by themselves, prove a successful compromise of a customer system or a data breach.
Security teams should review web-server and PHP logs for suspicious requests, repeated errors and unusual activity. They should also look for unexpected processes launched by web services, unfamiliar files, unauthorized changes to website code and unexplained outbound connections.
No single indicator proves that a server was compromised. Investigators need to examine the surrounding evidence and preserve relevant logs before making that determination.
If an organization finds signs of intrusion, it should isolate the affected system where appropriate, preserve evidence and begin an incident-response investigation. Teams should also assess whether passwords, API keys, authentication tokens or other secrets may have been exposed. They should rotate affected credentials when exposure is suspected and follow the organization’s incident-response procedures.
A new PHP advisory adds another step
The response changed again on October 23, when PHP published additional guidance concerning session upload progress.
The project recommended that administrators set session.upload_progress.enabled=0 until the next regular bug-fix release to protect against an unusual additional remote-code-execution path. The advisory says the issue requires a specific combination of configuration settings and application behavior; it does not apply equally to every PHP deployment. <Cite refs={[“turn957655view2”]}/>
Administrators who already applied that setting under the earlier guidance do not need to repeat the step. Others should review the official advisory and check whether their applications use the relevant configuration.
The additional guidance reinforces the need to monitor vendor updates after an emergency patch. Security work does not always stop with the first release, particularly when researchers uncover related conditions or when the original fix needs further refinement.
PHP says that configuration changes can reduce exposure to particular attack paths, but updating remains the only complete fix for the two original PHP2Shell vulnerabilities. Organizations should not treat a workaround as a permanent substitute for patching.
Why older systems are harder to fix
Not every organization can upgrade a production server immediately. Some rely on applications built years ago, plugins that no longer receive updates or custom code that depends on a particular PHP version.
Moving to a newer runtime can break compatibility. A change that appears straightforward on a test server may disrupt payment processing, online forms, customer accounts or other essential functions.
Teams must also determine where PHP is installed. Large organizations may operate several data centers, cloud environments, containers and third-party hosting accounts. A complete inventory can take time, particularly when different departments manage their own websites.
The work often involves several groups: security staff assess the threat, system administrators apply updates, developers test applications, service owners approve downtime and hosting providers patch infrastructure they control.
That coordination can be as demanding as the technical update itself. Taking a website offline may reduce exposure, but it can also interrupt public services and business operations. Leaving it online without adequate protection carries its own risks.
Where a patch cannot be applied immediately, administrators should follow the official PHP guidance, restrict public access where feasible and document the remaining risk. They should also agree on a clear deadline for applying a permanent fix.
What Philippine organizations need to check
The Philippines’ National Computer Emergency Response Team, known as CERT-PH, issued a PHP2Shell advisory on October 22. It warned government agencies, operators of critical information infrastructure, website administrators, hosting providers and cybersecurity organizations about the vulnerabilities.
The advisory identified possible risks to public-facing government services and private-sector systems using affected PHP installations. It also noted that organizations may depend on external hosting providers and outsourced systems, which should be included in vulnerability assessments.
The advisory did not establish a confirmed PHP2Shell compromise of a Philippine organization. That distinction is important: a warning about vulnerable systems is not proof that an attack succeeded.
Organizations in the Philippines should identify exposed PHP systems, confirm the installed versions and verify that providers have applied the relevant fixes. Agencies and businesses that use managed hosting should ask providers which PHP environments were affected, when they were patched and whether the provider found evidence of suspicious activity.
For public-facing services, the assessment should include systems that may not be managed directly by an agency’s own IT department. Outsourced websites, legacy portals and applications maintained under long-term contracts can otherwise escape the initial inventory.
JN’s reporting could not independently confirm the number of vulnerable Philippine systems, the number already patched or any locally confirmed compromise. Those figures should not be inferred from the scale of the global warning.
The human cost of emergency response
The technical response has also placed pressure on the people responsible for keeping websites available.
A report published on October 23 quoted UK-based system administrator Adam Mudd describing the response as “It’s been relentless.” Mudd said he was handling a surge of worried clients while coordinating updates across different systems. The same report described administrators dealing with outdated PHP versions, compatibility problems and the risk that an update could disrupt a working application.
The quotation’s source is a published interview, not a direct interview conducted by Journos News. It is therefore evidence of one administrator’s reported experience, not a representative survey of IT workers or a claim that all organizations faced the same workload.
Still, the operational problems he described reflect the multiple decisions teams must make during an urgent patching effort: which systems to update first, which services can tolerate downtime, how to test compatibility and how to investigate possible earlier exposure.
The response also requires clear communication. Alarmist or unverified claims about successful attacks can divert time from remediation, while vague warnings may leave system owners uncertain about what to do. Organizations need accurate technical guidance, verified incident information and clear responsibility for each affected system.
What comes next
PHP2Shell has exposed weaknesses that extend beyond a single software flaw. Organizations need accurate inventories, supported software, reliable relationships with hosting providers and a process for investigating incidents as well as installing patches.
The immediate priority is to confirm that every exposed PHP installation has received the appropriate security fix. Administrators should then restart the affected services, verify that the patched runtime is actually running, check logs and investigate suspicious activity from before the update.
Where a compromise is suspected, patching alone is not enough. Teams must determine what the attacker may have accessed, remove unauthorized changes and protect any credentials that could have been exposed.
For now, the public evidence establishes that attackers attempted to exploit PHP2Shell and that emergency fixes are available. It does not establish a confirmed breach of a Philippine organization.
The test for IT and cybersecurity teams is to close the known vulnerability without overlooking systems that are difficult to update—and to determine whether any exposed system was already compromised before the fix arrived.
Reporting Credit: PHP development team — October 21, 2026, security advisory and emergency releases addressing CVE-2026-109618 and CVE-2026-109619, followed by October 23 guidance on session upload progress. National Computer Emergency Response Team of the Philippines (CERT-PH) — October 22, 2026, PHP2Shell advisory for government agencies, critical infrastructure operators, website administrators and hosting providers. Amazon Threat Intelligence — October 21, 2026, findings on PHP2Shell exploitation attempts recorded by its MadPot honeypot before and after public disclosure. Published interview with UK-based system administrator Adam Mudd — October 23, 2026, account of the workload involved in coordinating updates and responding to concerned clients.
