Written By: Dan Ovick
Summary:
On Tuesday, October 21st, PHP announced 2 critical, unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. If exploited, these vulnerabilities discovered by Wiz Research could lead to server compromise, data exfiltration and defacement of compromised websites.
Nearly 70% of all websites are currently being impacted by 2 critical vulnerabilities involving PHP, a widely used scripting language that supports many different types of websites across the internet. According to Censys and its PHP2Shell dashboard, over 41 million PHP services were initially vulnerable and by Friday, October 23rd, over 33 million PHP services were still vulnerable.
Why Is This a Big Deal?
PHP is often found in public facing websites, combining that with the type of vulnerability, unauthenticated remote code execution, practically any threat actor from anywhere in the world can initiate an attack against a website with PHP embedded. The impact of exploitation can lead to the compromise of technologies, exfiltration of sensitive data and defacement of websites. Since nearly 70% of all public facing websites have a dependence on PHP, the likelihood of exploitation is high.
The FBI Cyber Division also released a statement in response to these vulnerabilities with guidance to immediately update impacted PHP instances if at all possible. If you are running a vulnerability version of PHP and a patch cannot be applied immediately, strongly consider taking your website offline until the patch can be applied.
How do I know if I’m affected?
Perhaps the most important question to ask right now is, “am I affected?”
Per PHP’s security advisory “all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”
This vulnerability impacts PHP versions as far back as version 5.4 and up to and including version 8.1. Keep in mind, PHP has not released patches for all impacted versions, only certain versions. Also, if you utilize a third-party platform with PHP embedded, they may have customized the code, requiring you to apply a unique patch from that vendor versus the PHP provided patch.
PHP isn’t necessarily just in websites, PHP is embedded across many other widely used platforms including Joomla, WordPress, and Drupal. According to an article released by HackRead, several hundred mobile apps running on both Android and Apple mobile devices connect to servers running vulnerable versions of PHP, increasing the impact from websites to mobile devices. F5 also released a security advisory stating certain F5 products could be impacted by these vulnerabilities. For a more in-depth list of platforms impacted by these vulnerabilities, please review NCSC-NL’s GitHub page.
Several entities have also created free PHP checkers that can assist in determining if your organization’s website is impacted by these vulnerabilities.
- Trend Micro PHP Checker – https://php2shell.trendmicro.com/
- Truvo Cyber PHP Checker – https://truvocyber.com/tools/php2shell-checker
Short-Term Remediation Strategy:
Once vulnerability exposure has been confirmed, next step is to determine the level of impact and identify the remediation path. Is PHP embedded within another third party managed application? Is PHP on a supported version? Can we patch immediately? Do we need to take our website offline? What mitigations can we put in place?
CISA has released an article providing remediation and mitigation guidance including:
- Identify assets running PHP within your environment and the specific version running
- Patch affected assets immediately
- If unable to patch immediately, take affected PHP assets offline (especially if internet facing)
- Consider mitigations such as a web application firewall
- Review your environment for suspicious activity, especially activity involving PHP worker processes that launch a shell or download a tool.
Long-Term Best Practices:
We are in a new age of vulnerability management with the continual adoption and growth of AI technologies. AI technology allows for vulnerabilities to be identified at a much faster rate and is able to develop an exploit even faster once a vulnerability is identified.
Organizations that maintain a strong asset inventory, including software composition analysis, have been able to quickly identify, respond and remediate/mitigate this risk. Also ensure you understand your asset criticality, how your assets interact together and what the impact would be if this vulnerability is exploited. This will help accurately quantify the risk to YOUR unique environment. For example, if your website has no sensitive data, no direct connection to internal resources and website defacement is a low risk, remediating this specific vulnerability becomes a lesser risk versus an organization who houses sensitive data on their website or requires a strong public persona that could be damaged by a defaced website.
Sources:
PHP Advisory – https://www.php.net/index.php#2026-10-21-5
FBI Notice – https://x.com/FBICyberDiv/status/2112921648252719420
NCSC-NL’s GitHub Page – https://github.com/ncsc-nl/php2shell
CISA Guidance – https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
HackRead Article – https://hackread.com/426-android-ios-apps-linked-php2shell-backend-risks/
F5 Security Advisory – https://my.f5.com/manage/s/article/K000163821
Censys Dashboard – https://php2shell.censys.com/
Trend Micro PHP Checker – https://php2shell.trendmicro.com/ Truvo Cyber PHP Checker – https://truvocyber.com/tools/php2shell-checker
