Millions of attempts to exploit two critical vulnerabilities in PHP have been detected worldwide, threatening websites and online services that rely on the server-side programming language. Designated CVE-2026-109618 and CVE-2026-109619, and collectively tracked as PHP2Shell, the flaws carry critical severity ratings of 9.2 out of 10. Both weaknesses allow attackers to execute code remotely on affected web servers without authentication, risking data theft, unauthorised system access and service disruptions.
Emergency security updates were issued on 21 October after technical details surfaced online ahead of their coordinated disclosure date, leaving system administrators little time to secure infrastructure before scanning and attack traffic intensified.
In Singapore, the Cyber Security Agency (CSA) joined international authorities in urging immediate remediation. Commissioner of Cybersecurity and CSA chief executive Gwenda Fong cautioned that businesses, particularly small and medium-sized enterprises relying on outsourced IT and hosting providers, could be exposed without realising it.
“The threat is immediate. Working exploits have been demonstrated, and security patches were released on 21 October. The priority now is to identify and patch vulnerable systems before attackers can exploit them,” Fong said in a LinkedIn post on 22 October. CSA is coordinating with government agencies, critical information infrastructure owners, major enterprises and industry partners to accelerate patching, while reaching smaller businesses through industry associations and cybersecurity providers.
Exploitation attempts began before public disclosure
The PHP development team originally scheduled the updates for 22 October, but brought the release forward by 24 hours after vulnerability identifiers began circulating online on 20 October. While the initial leak contained limited technical data, the PHP Foundation noted that a subsequent demonstration video published online exposed enough detail to accelerate the development of functional proof-of-concept exploits.
Targeting had begun even before the identifiers surfaced. Amazon Threat Intelligence reported observing an exploitation attempt on 17 October via its MadPot monitoring infrastructure, four days ahead of the emergency patch release. The activity originated from an IP address routed through a commercial anonymisation network. Amazon said it could not determine how the actor learnt of the vulnerabilities or whether the attempt would have succeeded against production environments.
Following the public release, attack volumes surged rapidly. Cloudflare chief executive Matthew Prince stated that observed exploitation attempts climbed from thousands prior to the announcement to tens of thousands within 45 minutes, before surpassing several million. While these telemetry figures track attempted exploit payloads rather than verified server compromises, the volume reflects an immediate, automated effort to locate vulnerable endpoints worldwide.
The threat prompted precautionary shutdowns of government portals and public-sector digital services in multiple jurisdictions, allowing administrators to audit configurations and deploy patches offline. While temporarily disabling public access reduced immediate exposure, it carried operational consequences for dependent users and organisations.
Why the vulnerabilities affect widely used web platforms
As a core server-side scripting language, PHP processes requests, manages database transactions and generates dynamic content. The runtime underpins major content management systems, including WordPress, Drupal and Joomla, as well as bespoke enterprise applications and web portals. Estimates from Tenable Research indicate that nearly 70% of websites with known server-side languages rely on PHP, though overall exposure depends on specific version numbers, deployment configurations and the availability of security updates.
The severity of PHP2Shell stems from weaknesses within PHP’s core runtime rather than defects in individual web applications. Both vulnerabilities involve memory-handling errors that occur when the engine handles unexpected request failures. Under specific execution conditions, attackers can manipulate corrupted or previously released memory to execute arbitrary code remotely or extract data retained in server processes.
A successful breach gives attackers access to website files, stored configuration details, authentication tokens, and databases accessible to the compromised PHP process. Intruders can use this access to alter website content, exfiltrate sensitive records, or establish persistent administrative access.
Because the weakness lies in the shared execution environment, websites can remain vulnerable even with fully patched application software. Security researchers demonstrated successful exploitation across WordPress, Drupal and Joomla deployments, showing that infrastructure vulnerabilities affect multiple platforms regardless of flaws in their application code.
Singapore businesses face challenges identifying affected systems
For organisations in Singapore, locating vulnerable infrastructure may prove as challenging as applying the updates. Many enterprises outsource website development, maintenance and hosting, leaving them dependent on third-party providers to identify affected PHP installations and deploy fixes.
CSA advised organisations to audit all systems running PHP, prioritise internet-facing servers, and verify whether internal applications bundle vulnerable components indirectly. Alongside updating software, businesses were encouraged to review infrastructure logs for indicators of compromise dating back to mid-October. Remediation processes vary significantly depending on how PHP is deployed. Organisations on managed hosting platforms rely on their service providers to distribute updates, while businesses running their own servers must schedule package installations, restart affected services, and verify that corrected binaries are running.
Software dependencies introduce further complexity. Satnam Narang, Senior Staff Research Engineer at Tenable, pointed out that while mainstream Linux distributions and long-term support providers distribute backported updates relatively quickly with advance notice, legacy environments and integrated software suites face substantial delays. “For systems running end-of-life versions of PHP, it could take weeks or months, or these systems may never get updates,” Narang said.
Where PHP is bundled directly into commercial off-the-shelf software or embedded appliances, administrators cannot update the language binary independently. In such instances, businesses require formal confirmation and custom update packages from software suppliers to neutralise the risk.
WordPress users must update underlying PHP software
The architecture of WordPress makes these vulnerabilities an immediate operational concern for site operators. WordPress security provider Wordfence emphasised that updating WordPress core, themes or plugins does not resolve PHP2Shell. The vulnerability exists within the PHP service handling web requests, requiring updates at the hosting and runtime layer.
Wordfence’s preliminary testing revealed varied exploitation behaviour. In laboratory testing, researchers achieved remote code execution on a specially configured PHP build, whereas the identical exploit payload caused the process to crash rather than execute code on a normally optimised build. While real-world reliability depends on server configuration and memory layout, maintainers cautioned that process crashes disrupt availability and do not establish that unpatched installations are safe.
The PHP development team addressed the vulnerabilities on 21 October with the release of versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Releases in the PHP 8.1 branch and earlier fall outside normal project support, leaving administrators on legacy installations dependent on backported security patches from operating system vendors or third-party maintainers.
WordPress administrators can verify the PHP version serving their website by navigating to Tools > Site Health > Info and Server in the administrative dashboard. Those using managed hosting should confirm that their provider has installed fixes for both vulnerabilities and restarted the PHP service. Self-managed environments require equivalent verification, while containerised deployments must be rebuilt using updated base images.
Wordfence also advised administrators to preserve server access and security logs and review suspicious activity where patching was delayed. While temporary network protections and web application firewall rules can block specific exploit methods, the PHP development team warned that updating the underlying runtime remains the only complete remediation.
AI-assisted discovery exposes wider software security challenges
The timeline leading to the PHP2Shell disclosure highlights operational strains on open-source project maintainers as automated research tools accelerate vulnerability discovery. Disclosures from the PHP Foundation indicate that the underlying memory-handling issue was first identified during security work in 2024. At the time, researchers recognised a potential weakness but had not established a practical exploitation method. Proposed fixes also raised concerns about performance penalties and potential incompatibilities across the wider PHP extension ecosystem, contributing to longer delays.
The issue’s severity became clear in August 2026, when researchers from Calif, OpenAI, and Wiz independently demonstrated workable exploit methods developed with the assistance of artificial intelligence tools. These findings prompted coordinated efforts to engineer, test and distribute security updates before public disclosure.
The PHP Foundation acknowledged that limited engineering resources and historical review procedures contributed to the delay. While the organisation has since updated its security processes, open-source maintainers face a growing number of vulnerability submissions that require extensive manual validation, testing, and cross-platform verification.
Automated analysis tools have reduced the time needed for researchers and external actors to identify intricate memory weaknesses and develop functional demonstrations. In contrast, maintenance teams still face an intensive, deliberate process of evaluating findings, resolving compatibility issues, and coordinating updates across global server environments.
For businesses, effective defence against ongoing exploitation requires maintaining an accurate inventory of server environments. Because PHP serves as underlying infrastructure rather than a visible user application, securing exposed systems requires close coordination among internal technical staff, external developers, and hosting providers.
