The PHP Foundation has released a patch that addresses two critical vulnerabilities in PHP, but the real work of dealing with patching and upgrading has only just begun.
And for many, it may be too late.
“As expected, watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities, with a variety of vibecoded PoCs already hitting our sensors featuring a variety of ‘php2shell’ User-Agents,” Jake Knott, head of threat intelligence for watchTowr, told Cyber Daily.
“Whilst nobody has been successful to date, we don’t expect that will last long.”
The Australian Cyber Security Centre issued an urgent warning late on 21 October, and the US cyber agency, CISA, followed soon after.
“CISA strongly urges organisations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as ‘php2shell’, allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests,” CISA said overnight.
“Organisations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organisations if left unpatched.”
An additional wrinkle for site administrators and security teams, however, is that only PHP 8.2 and older are getting a patch – older versions will need to be upgraded before they can be patched, and many organisations may not even be aware of every old server. The PHP Foundation’s warning for organisations in those circumstances is stark.
“There are no complete mitigations, updating is the only safe choice,” it said.
According to application security firm Detectify, the first time many organisations will discover they’re running a forgotten PHP server is when it inevitably comes under attack.
“That’s the risk with this one: the flaws became public before the fix did, so both sides are starting at the same time. Attackers aren’t waiting for a working exploit. They’re building a list of every server on the internet that says it runs PHP, sorted by version, and the moment the fix is out, they will compare the old code with the new one to find the flaw,” Detectify’s Security Research team said overnight.
“The playbook used to be: patch comes out, attackers reverse-engineer it over a few days, defenders have a window. That window is closing. Recent research has shown AI models turning a security patch into a working exploit in under an hour, for a few thousand dollars in computing costs. PHP2Shell is landing in that world, and some researchers expect mass exploitation within minutes of the release.”
The company’s own research suggests “roughly half” of all PHP installs are running a version that will not have a patch released. Given 70 per cent of the internet is powered by PHP, that equates to a truly alarming number of vulnerable websites.
“That’s the real exposure. Those sites haven’t been updated in years, which usually means nobody is watching them either,” Detectify said.
“So the question this week is this: do you know where all your PHP is running? If yes, this is an afternoon of updates. If no, the risk is in the systems you’ve forgotten: an old marketing site, a hosting control panel, a device with PHP built in. And speed matters more than ever.
“Our own Cyber Hygiene Index found that nine in 10 open critical and high-severity vulnerabilities stay exposed for more than 90 days. Against an exploit that can be built in an hour, that gap is the whole story. Find your forgotten systems before someone else does, and then check nobody got there first.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
