Two critical flaws in PHP, the programming language that runs a large part of the web, can let hackers run their own code on servers from afar without logging in, putting millions of internet-facing services at risk.
Known together as PHP2Shell, the flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP rates both 9.2 on the CVSS v4.0 scale, which makes them critical. PHP has released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but security firms warn that a large number of servers are still unpatched or running versions that no longer get support.
Also read: Indian patch patrol sets out to resolve PHP risk
On October 23, PHP also asked users to switch off its session upload progress feature until the next regular bugfix release. This is meant to cut the risk from a third, narrower flaw.
According to a Times of India report by Shilpa Phadnis, companies can be exposed through commercial applications, hosting providers and embedded software even if they do not build PHP applications themselves. PHP powers platforms such as WordPress, Drupal, Joomla and Magento.
Censys counted about 36.7 million internet-facing services reporting potentially affected PHP versions in its October 22 snapshot, TOI reported. These are service counts, not unique servers or organisations, and may include installations already patched through vendor updates.
Qualys found 167 million PHP package installations across 12,000 organisations, and 73 per cent of them sit on internet-facing assets. Saeed Abbasi, head of the firm's Threat Research Unit, said patching alone will not help systems on unsupported versions, and that nearly all installations are either vulnerable or unsupported.
Aamir Lakhani, global director of threat intelligence and adversarial AI research at Fortinet, called the flaws an "urgent security and business continuity risk" for firms that rely on websites and customer portals.
India's share
CloudSEK said Shodan found 2.2 million internet-facing services showing PHP information worldwide. India ranks ninth with 53,400 of them. Of 36,700 Indian services that reveal their PHP version, about 36,100 are unpatched, including 19,500 on versions that have reached end of life, said CloudSEK researcher Akash Karthi.
What the flaws do
CVE-2026-109618 is triggered when a request makes PHP run out of memory. PHP can be interrupted while internal request data is only partly set up, and cleanup may then treat the invalid data as valid. CVE-2026-109619 involves internal request data that survives after the memory behind it has been freed.
The flaws sit in PHP itself and not in any one app or plugin, so a site can be exposed even if its own code is sound. According to PHP, all unpatched installations that handle web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP assesses the risk as greatest for mod_php, because a demonstrated exploit lets an unauthenticated request trigger the flaw before the application's own code runs, the Canadian Centre for Cyber Security said in an alert.
Patch gaps for older versions
PHP has not issued official fixes for older branches. CERT-EU, the cybersecurity unit of EU institutions, said in its advisory that all versions from PHP 5 onwards may be affected, but noted that this came from public posts and not from PHP itself.
PHP has said no configuration change fully mitigates the flaws. Switching off session upload progress blocks only some of the attack routes. Security firm Kaspersky has advised administrators to check package changelogs, because Linux distributions may fix the flaws without changing the version number. PHP's 8.2 branch is also due to lose security support on December 31, 2026.
Details of the flaws reportedly leaked on October 20, through a post on an online forum, ahead of the planned disclosure. PHP then told administrators to prepare for emergency updates. CERT-EU advised organisations to prepare for immediate patching and, if needed, to isolate internet-facing PHP applications from public networks.
Security firm watchTowr said it has observed exploitation of the flaws in the wild. Security firm Sygnia said a public exploit repository has shown remote code execution against PHP 8.4.26 running Apache mod_php in a lab setup.
Also read: What to know about the AI-detected security bug impacting wide swaths of the internet
In its October 23 advisory, PHP detailed a separate issue, CVE-2026-115560. It needs an application to set the session serialisation handler to php_binary or php_serialize, switch it to php at runtime, and leave session upload progress enabled. PHP called the setup unlikely in practice and said it will publish a full advisory with the next release.
Until then, PHP recommends turning off session upload progress, which is enabled by default. TOI reported that users who have already disabled the feature need to take no further action. The only visible effect for most sites is that upload progress bars stop working. The uploads themselves continue.
(With inputs from TOI)