A Critical PHP Vulnerability Is Putting Websites at Risk. Should We Be Worried?
Two critical security vulnerabilities in PHP have triggered urgent warnings for website owners and IT teams worldwide.
The technology behind a large part of the internet is facing a serious security challenge. PHP, a programming language widely used to build websites and web applications, has been affected by two critical vulnerabilities that could allow attackers to take control of vulnerable servers remotely.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, were addressed in emergency security updates released on 21 October 2026. Both vulnerabilities received a critical severity rating of 9.2 out of 10, highlighting the urgency of the situation.
The development has raised concerns about the security of websites and online services that depend on PHP, particularly those running vulnerable versions exposed to the internet.
What is PHP, and why does this matter?
PHP is a server side programming language. In simple terms, it helps websites process information, manage user accounts, handle forms, communicate with databases and deliver dynamic content.
It is used across a broad range of websites and web applications, including platforms built with popular content management systems. This widespread adoption means that a vulnerability in PHP can have consequences beyond one website or organisation.
When a weakness affects the underlying technology powering a website, attackers may be able to target the server itself rather than exploiting a flaw in the website's design or content.
What makes these vulnerabilities dangerous?
Both vulnerabilities could enable unauthenticated remote code execution. This means an attacker may be able to execute malicious code on an affected server without first logging in.
Depending on the server's configuration and permissions, a successful attack could lead to website disruption, unauthorised access to sensitive information, or further compromise of the affected system.
The vulnerabilities involve errors in how PHP manages memory during request processing and certain error conditions. Exploiting these weaknesses could cause the application to handle memory incorrectly, potentially giving an attacker an opportunity to execute code.
Not every website using PHP is automatically compromised. The actual risk depends on the PHP version, configuration, exposure and whether the relevant security updates have been applied. However, organisations running vulnerable installations should treat the issue as urgent.
Is the internet at risk?
The short answer is that the internet is not about to collapse, but the risk is serious.
The internet relies on layers of interconnected technologies. A vulnerability in a widely used component can affect many services at once, particularly when organisations share the same software dependencies or delay applying security updates.
This incident is a reminder that even established technologies can contain vulnerabilities with far reaching consequences. It also demonstrates why cybersecurity requires continuous monitoring, timely patching and an understanding of the systems operating behind a website.
What should organisations do?
The PHP development team has released security updates for supported branches, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations should identify affected installations and upgrade to the appropriate fixed release as soon as possible.
Security teams should also review third party applications and hosting environments that may include PHP components, prioritise internet facing systems, and monitor for unusual activity that could indicate compromise.
Where an affected system cannot be patched promptly, organisations should consult official security guidance and consider isolating vulnerable internet facing services until the issue is resolved.
For businesses, the lesson is straightforward: keeping websites secure involves more than protecting user accounts or installing security software. It also means maintaining the underlying technologies, monitoring for emerging threats and responding quickly when vulnerabilities are disclosed.
Watch the BBC News report below for more on the PHP vulnerability and the questions it raises about internet security.
Video: BBC News | A flaw in PHP is taking down websites. Is the internet at risk?
Comments