Hackers exploit critical PHP flaws as governments scramble to patch

The most widely used web programming language has been hit by two severe vulnerabilities that attackers are already exploiting, prompting governments and major websites across the Asia-Pacific region to implement urgent fixes.

Security researchers confirmed both flaws—tracked as CVE-2026-109618 and CVE-2026-109619—were actively targeted within hours of their public disclosure. Dubbed PHP2Shell, they enable attackers to execute code remotely on web servers without requiring authentication. Both vulnerabilities carry a severity rating of 9.2 out of 10, the second-highest possible score.

PHP, which powers approximately 70% of all websites, released emergency patches at 14:00 UTC on October 21 after details of the flaws leaked online the previous day. The updates cover versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, older versions, including 7.4, 8.0, and 8.1, initially had no direct upgrade path, leaving millions of sites exposed. Red Hat and AlmaLinux later backported fixes to retired PHP versions, but many smaller websites, particularly those running outdated systems, remain at risk. The flaws were discovered by security firms Calif and Wiz, which used AI models to identify these weaknesses. OpenAI, whose model Calif used, called them “one of the most impactful security issues in recent memory.”

Governments in Australia, Singapore, and Japan have issued urgent warnings. The Australian Cyber Security Centre (ACSC) classified the threat as critical, its highest alert level, and confirmed its own website, cyber.gov.au, was affected. Singapore’s Cyber Security Agency issued a general warning, while Japan’s Prime Minister Sanae Takaichi addressed the issue publicly. Multiple services, including childcare systems and online gaming platforms, were temporarily taken offline as a precaution.

Exploits spread as attacks surge

Security vendors report active exploitation attempts. Patchstack confirmed multiple incidents, while Cloudflare detected early attacks. Hadrian, a security firm, noted that the PHP session upload progress path was being abused at scale.

While remote code execution has dominated coverage, PHP’s advisories also highlight a secondary risk: memory disclosure. Attackers could extract sensitive data, such as passwords, session tokens, and API keys, from a server’s memory without triggering any visible breach. This could trigger data protection obligations under laws like Australia’s Notifiable Data Breaches scheme or Singapore’s Personal Data Protection Act, even if the website itself remains operational.

The vulnerabilities impact all PHP configurations, but some setups pose greater risks. Apache’s mod_php is considered the most dangerous, followed by PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Although exploits against PHP-FPM have not yet been demonstrated, analysis suggests it is also vulnerable.

WatchTowr reported that decoy servers had already recorded exploitation attempts against both flaws. No confirmed breaches at real organizations had been disclosed by the time the patches were released, but public exploit code is now circulating. The Dutch National Cyber Agency warned that large-scale attacks are imminent.

Global shutdowns as risks escalate

European governments also responded swiftly. Authorities in the Netherlands, Finland, and France took websites offline, and parts of Wikipedia were temporarily disabled as a precaution. The scale of the exposure is unprecedented, with thousands of websites, from government portals to e-commerce platforms, potentially at risk if patches are delayed.

The flaws had been embedded in PHP’s code for decades before their discovery. In 2024, a separate critical PHP vulnerability was actively exploited in Japan, Singapore, and the U.S., with Singapore’s cyber agency later confirming ongoing attacks. The region’s history of underinsurance for cyber risks, particularly among small businesses, could worsen the fallout, as many exposed organizations may lack coverage for data leaks or operational disruptions.

For organizations still running unpatched systems, the immediate priority is identifying all PHP instances and applying the latest fixes. The ACSC advises Australian businesses to contact 1300 CYBER1 (1300 292 371) if they suspect an intrusion. With attacks already underway, any exposed server should be scanned for signs of compromise.

Exploitation Trends and Coverage Gaps in Asia-Pacific Cyber Risks

Insurance data shows Pacific cyber premiums dropped 6% in the third quarter, yet claims frequency is rising, particularly from supply chain-related incidents. In Asia, coverage remains limited, with Swiss Re estimating the region accounts for just 10% of global cyber premiums, around $1.56 billion, despite high digital exposure. Small and medium-sized businesses, often most vulnerable to PHP2Shell due to outdated systems, typically lack sufficient insurance.