This week, India joined a worldwide scramble to patch one of the most serious software flaws of the year. Two critical holes were discovered in PHP, the programming language that quietly powers a huge share of the world’s websites, and hackers are already trying to exploit them. If your website runs on PHP, which most of them do, this is one of those moments where you do not wait for the weekend.
The flaws, now being called PHP2Shell by some security researchers, were identified on October 20. A day later, India’s Computer Emergency Response Team, CERT-In, issued a critical-severity alert and told organisations to install the security fixes immediately. The warning is blunt: the vulnerabilities could allow a remote attacker to execute malicious code on a targeted system and take complete control of it.
What exactly went wrong
PHP is not some niche tool. It is the engine behind dynamic websites everywhere, handling logins, forms, databases and payment pages. Around 70 per cent of the world’s websites use it, and it underpins massively popular platforms such as WordPress, Drupal and Joomla. That is why a flaw in PHP’s core engine is so dangerous: it can expose a website even when its owner has done nothing wrong.
The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. In plain terms, they stem from problems in how PHP handles memory and failed requests. Under certain conditions, data left behind while a request is being processed can be abused to run unauthorised commands or read sensitive information stored in server memory.
The most worrying part is that an attack can be launched with a specially crafted request sent over the internet, without any login or authentication. A successful attack could let criminals steal confidential data, pull out passwords, change website content, disrupt services, or use a compromised server to attack other machines on the same network. The risk is highest for setups using mod_php, where an unauthenticated request can trigger the flaw before any application code even runs.
The PHP team released fixes on October 21, one day after the flaws were identified. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your server runs an older release, the only complete fix is to update to one of
Why India is on high alert
CERT-In published its advisory as vulnerability note CIVN-2026-0510 on October 21 and classified the issue as critical. Its message was clear: reports confirm large-scale exploitation attempts in the wild, and organisations and individuals using the affected versions must apply the security updates urgently.
The advisory hit home for a simple reason: a large share of websites in India runs on PHP. Government websites, MSME portals, e-commerce stores, blogs and payment gateways all rely on it. Indian companies, especially smaller firms, are rushing to patch their websites after the disclosure. Businesses that cannot patch right away have been told to identify vulnerable systems and assess whether internet-facing servers should be temporarily taken offline until the fix is applied.
It is worth noting that this is not a theoretical threat. Attacks on websites often pick up speed right after a public disclosure, as criminals race to catch the systems that have not been updated yet.
The world scrambled too
India is far from alone. The response around the world has been unusually fast and dramatic:
- United States: The National Security Agency warned that PHP’s widespread use creates an opening for malicious cyber actors, and urged organisations to prepare for immediate updates. Security researchers also reported exploit attempts before and around the public disclosure.
- Netherlands: Public-facing government and institutional websites were taken offline as a precaution while fixes were applied.
- Finland: The state IT services provider suspended some public network services.
- France: The Interior Ministry put its websites under preventive maintenance.
- Big tech: Google Cloud said its own infrastructure was not vulnerable but warned that customers running PHP applications on its platform could be exposed, urging them to update and redeploy. OpenAI and the FBI also issued warnings. Cloudflare said it saw thousands of exploit attempts in the 10 hours before the flaws were publicly announced, and rolled out mitigations for its customers.
What website owners must do right now
If you run a website, a blog or an online store, here is the practical checklist:
- Update immediately. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on your release line. This is the complete remediation; a web application firewall or other temporary defence is not an adequate substitute.
- Check which version you run. Your hosting provider’s control panel or a quick check with your developer will tell you. Replace any unsupported or end-of-life PHP versions entirely.
- Monitor for suspicious activity. Patching alone does not tell you whether a system was already compromised before the fix went in. Watch server logs for unusual requests and activity.
- Isolate if you cannot patch. If a vulnerable internet-facing system cannot be patched promptly, assess whether it should be temporarily isolated from public networks until remediation is done.
- Ask your host. If you use shared hosting or managed WordPress hosting, ask your provider when the patch will be applied, and confirm the fix rather than assuming it.
For everyday readers, there is no need to panic about browsing the web. The risk sits with website operators and server administrators, not with people visiting websites. But if you own or manage any site, even a small one, this is a drop-everything moment.
FAQs
What is the PHP2Shell vulnerability?
It is the name researchers have given to two critical flaws in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619. They could let attackers run malicious code on web servers remotely, without logging in.
Is my website at risk?
If your site runs on an unpatched version of PHP, yes. The affected versions are those older than 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Sites on WordPress, Drupal and Joomla are especially worth checking, since all three are built on PHP.
What did CERT-In say?
CERT-In issued a critical advisory on October 21, 2026, confirming large-scale exploitation attempts in the wild and urging immediate installation of security updates. Patching is the only complete fix.
What if I cannot update right now?
Security agencies say you should consider temporarily taking vulnerable internet-facing systems offline or isolating them from public networks until you can apply the fix. Do not rely on temporary defences alone.
The internet runs on a surprising number of quiet, invisible components, and PHP is one of the quietest and most essential of them. This week’s alert is a reminder of what happens when one of those components breaks. The fix is out, the world is patching, and the clock is ticking for anyone who has not updated yet.
