Critical PHP security flaws put millions of websites at risk worldwide
Two high-severity vulnerabilities could allow hackers to take control of servers, prompting urgent security updates
22 October, 2026
TT
16
Two critical security vulnerabilities have been discovered in PHP, the widely used programming language powering millions of websites worldwide, raising concerns over potential cyberattacks, data breaches and disruptions to online services.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have each received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS) version 4.0.
According to the PHP security advisory, the flaws could allow unauthenticated attackers to remotely execute malicious code on vulnerable servers, potentially gaining control of affected systems without requiring login credentials.
The PHP development team released emergency security updates on October 21, urging organisations, website administrators and hosting providers to install the patches immediately.
The vulnerabilities have been collectively dubbed ‘PHP2Shell’ by cybersecurity researchers.
PHP vulnerability: Millions of websites potentially exposed
PHP is one of the internet’s most widely used server-side programming languages and underpins popular content management systems, including WordPress, Drupal and Joomla.
Cybersecurity company Wiz said its researchers had uncovered multiple critical vulnerabilities in PHP’s core engine, including flaws capable of exposing sensitive information and enabling remote code execution.
Unlike vulnerabilities affecting individual website plugins or applications, these security weaknesses exist within PHP itself, potentially exposing a broad range of websites and enterprise applications.
Wiz said PHP powers approximately 70 per cent of websites globally, highlighting the scale of the potential exposure.
Meanwhile, cybersecurity firm Palo Alto Networks’ Unit 42 reported identifying more than 22.6 million exposed instances potentially vulnerable to the two flaws, based on its telemetry. The figure represents potential exposure rather than confirmed compromises.
Successful exploitation could allow attackers to steal sensitive business information, compromise websites, execute unauthorised commands or disrupt online operations.
Cybersecurity agencies issue urgent warnings
The discovery has prompted warnings from international cybersecurity authorities.
In a joint statement issued on October 21, the European Union Agency for Cybersecurity (ENISA), European Commission, Europol and other European cybersecurity bodies urged organisations to take immediate action.
The agencies advised businesses to identify PHP-based applications, coordinate with hosting providers and prioritise security updates for internet-facing systems.
The UK’s National Cyber Security Centre (NCSC) also issued an alert calling for urgent mitigation measures.
Cybersecurity researchers have warned that Apache servers using the mod_php configuration face particularly serious risks, with a demonstrated exploit capable of triggering before application code begins running.
PHP releases emergency security patches
The PHP development team has released four updated versions to address the vulnerabilities:
– PHP 8.5.12
– PHP 8.4.27
– PHP 8.3.36
– PHP 8.2.35
Organisations operating older PHP installations are also being urged to assess their exposure, as versions 8.1 and earlier no longer receive regular security updates from the PHP project.
Although temporary mitigation measures are available, PHP maintainers have stressed that upgrading to a patched version is the only complete solution.
What the PHP security threat means for businesses
The vulnerabilities present significant risks for enterprises relying on PHP-powered websites, customer portals, e-commerce platforms and other digital services.
For organisations across the UAE and wider GCC, the discovery highlights the importance of maintaining updated web infrastructure, particularly as businesses accelerate digital transformation and expand their online operations.
Potential consequences of a successful attack include unauthorised access to customer information, service disruptions, financial losses and reputational damage.
Security researchers have also reported evidence of exploitation attempts targeting the vulnerabilities.
Cloudflare has observed attack traffic associated with the flaws, including attempts to bypass existing security protections, according to cybersecurity firm Qualys.
Businesses have been advised to conduct immediate security assessments, identify potentially affected PHP installations and coordinate with their technology vendors to deploy the latest patches.
Organisations unable to update immediately should consider restricting public access to vulnerable applications until the necessary fixes can be installed.
The incident underscores the growing cybersecurity risks associated with vulnerabilities in widely deployed software components, where a single weakness can potentially affect millions of websites and business applications globally.
