Critical PHP2Shell vulnerabilities threaten millions of websites with potential remote code execution attacks. (Image source: iStock)
Two critical vulnerabilities in PHP, a programming language powering about three-quarters of the web, have triggered a global cyber security alert after details of the flaws, dubbed PHP2Shell, reportedly leaked before their planned disclosure and patching.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code remotely on vulnerable servers without authentication. PHP is widely used to build websites, web applications and back-end services, including platforms running WordPress, Drupal, Joomla and Magento.
BBC cyber correspondent Joe Tidy said researchers had identified a potential flaw in 2024 but could not establish how it could be exploited until AI-assisted research produced a viable attack method.
“It’s part of the invisible infrastructure that we all take for granted; many websites use this, potentially 70% of websites out there," he said. "It all goes back to 2024, when the researchers at PHP had a potential worry about a theoretical flaw in the language that might lead to cyber attacks – but back then, they couldn’t really work out how it would be possible to actually conduct an attack using this method.
“Then along comes AI. Using some frontier models by OpenAI, some researchers came up with an actual method that you could use to carry out that attack. So, they were right, but they weren’t quite good enough in terms of the cyber security skills, without AI, to figure out how it would be possible. OpenAI, a company called Calif and a company called Wiz between them came up with two very serious flaws in PHP, and they came up with a plan to issue a patch. It was all going to be very civilised and people would download the software patches, but then someone leaked the details of this potential flaw and that’s what started a frenzy in the cyber crime world.”
Ryan Austin, a researcher at Calif, told the BBC: “This is the most serious vulnerability I’ve ever found.”
Sergey Lozhkin, head of the Global Research and Analysis Team for APAC and META at Kaspersky, said the vulnerabilities could have significant consequences because of PHP’s widespread use.
“The potential impact is considerable: if successfully exploited, this vulnerability could enable remote code execution, one of the most serious forms of cyber compromise. In practical terms, attackers could potentially execute malicious code on affected systems, including the deployment of web shells, thereby gaining control over vulnerable servers,” Lozhkin said.
He urged organisations using PHP to apply patches immediately to limit exposure and protect critical systems.
Don Smith, VP of threat intelligence at Sophos Counter Threat Unit, said organisations must first identify every instance of PHP running across their infrastructure.
“The immediate challenge is not simply installing a patch but finding and managing every instance where PHP is running. The use of PHP is pervasive; it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it. Security teams should prioritise internet-facing systems, confirming which versions are affected as soon as the official advisory is published, and apply the updates without delay.”
Smith warned that attackers could quickly target the flaws. “It is crucial that organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold.”
Check Point Research reported that 10% of organisations globally had been affected since details of the vulnerabilities leaked. Africa recorded a 4% impact rate, compared with 14% in Europe.
In Kenya, 7% of organisations had been hit, compared with 2% in SA. Government bodies in the Netherlands and Finland took websites offline as a precaution.
Telecommunications was the most affected industry globally, at 20%, followed by education at 18%.
Check Point said updating websites or plugins would not resolve the vulnerabilities because the flaws reside in the PHP engine itself. Organisations must patch PHP on their servers. Screenshots of a PHP2Shell attack tool were already circulating.
Lotem Finkelstein, VP of research at Check Point Software Technologies, said the leak had reduced the time available for security teams to prepare.
“The concern surrounding PHP2Shell stems from the combination of the vulnerabilities' severity and the widespread use of PHP, which underpins websites, e-commerce platforms and many enterprise services. The two critical vulnerabilities could allow attackers to execute code remotely, and the leak of their details ahead of the planned disclosure is narrowing the window for security teams to prepare. Because these vulnerabilities reside in the PHP engine itself, updating a content management system or its plugins alone is not enough.”
Charlotte Wilson, head of enterprise at Check Point Software Technologies, said the flaws could expose organisations across sectors.
“The scale of this is enormous. We're talking about two serious security flaws in technology that underpins around three-quarters of the internet, potentially allowing criminals to access vulnerable systems remotely without even needing a password.”
Wilson said the incident highlighted the dependence of governments, businesses, banks and public services on shared digital infrastructure, and pointed to growing regulatory scrutiny of technology providers supporting critical services. She said warnings from the National Cyber Security Centre about AI increasing the frequency and intensity of cyber attacks added to the concern.
“Criminals are becoming faster at identifying weaknesses and exploiting them, leaving organisations with less time to respond. When governments are choosing to take their own websites offline rather than risk leaving them exposed, it gives you a pretty clear indication of how seriously this is being taken. The immediate priority is getting systems updated, but the bigger question is whether we've become too dependent on technology that can leave so many organisations vulnerable at exactly the same time."
Perforce Zend, an enterprise PHP development, security and support platform owned by Perforce Software, advised organisations to prioritise patching while planning for applications that cannot immediately be upgraded.
“Patching these vulnerabilities is the immediate priority, but organisations also need a plan for the PHP applications they cannot upgrade straight away. Long-term support can give teams breathing space to migrate safely while continuing to receive security fixes,” said Matthew Weier O’Phinney, PHP Foundation board member and product manager at Perforce Zend.
He cited Perforce Zend’s 2026 PHP Landscape Report, which found that about 40% of survey respondents were deploying end-of-life software. Of those, only one in four used long-term support.
“This is a wake-up call that enterprises must prioritise both the immediate threat and their longer-term exposure,” he added.
Finkelstein said organisations should inventory all PHP instances, including those in containers and third-party products, prioritise internet-facing servers and identify unsupported versions.
Alongside applying official updates as soon as they become available, he urged security teams to monitor for suspicious activity, including web servers executing system commands, new files appearing on websites and outbound connections to unknown destinations.
Forrester analysts said PHP2Shell is not just a patching exercise but puts resilience programmes to the test.
“Security teams must make decisions while information remains incomplete, exploits might emerge and the full extent of exposure may still be unclear. That starts with knowing which critical business services depend on PHP, including dependencies hidden within third-party products and services. Prioritise internet-facing applications to be patched first. If you are hosting a content management system such as WordPress, it is not enough to just update WordPress and any plugins; you must ensure that the underlying PHP runtime is patched,” they said.
“Where you can’t patch, conduct a risk assessment that considers whether an application’s memory stores passwords, tokens or API keys. If none of these avenues are available, the last resort is to take the system offline.”
They added that organisations should hunt for signs of compromise. "Attackers had a head start, so patching alone does not close the incident. Look for web shells, suspicious child processes spawned by PHP, unexpected file changes and new admin accounts on any system that ran a vulnerable version."
Warren Olivier, regional VP for Africa at Cloudera, said AI helped researchers find PHP2Shell, but the same tools in criminal hands will cut the time between the next leak and the first attack dramatically.
"This is a development that is startlingly broad in its impact, with millions of affected services, businesses and processes worldwide. The fact that this has happened during Cyber Security Awareness Month demonstrates the importance of this issue.
"For that reason, organisations in South Africa should spend the rest of this month mapping which servers hold which data, as it will play a big role in deciding how fast they can patch the next flaw and what they may need to report under POPIA," said Olivier.