What do businesses need to do to protect their websites against PHP vulnerabilities?
(Dan Tri) - According to information from the Department of Cyber Security and the National Cyber Security Association (NCA), two security vulnerabilities carrying the codes CVE-2026-109618 and CVE-2026-109619 in the PHP programming language have been officially patched.
On October 21, the developers of PHP, the programming language used to build websites, currently operating about 70% of websites globally, announced a serious security vulnerability that allows attackers to take control of any server running this software.
The vulnerability, named PHP2Shell, is essentially a group of issues related to the way PHP manages computer memory. It can be exploited in a variety of ways, in some cases taking just a few seconds, to run unauthorized code on unpatched servers.
Vulnerabilities are all scored 9.2 points on the CVSS v4.0 scale, a scale measuring the severity of vulnerabilities, with a maximum of 10 points.
If exploited, an attacker could remotely execute code on a web server running PHP without logging in. The vulnerability discovered by security firm Wiz and several research groups, with the support of AI, was reported to the PHP development team before publication.
Patched PHP versions include 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For versions 7.4, 8.0, and 8.1 (which have ended official support), the PHP team provides a fix in source code form. Many Linux distributions such as AlmaLinux, Red Hat, Debian, Ubuntu and long-term support providers have released update packages.
Not all websites using PHP are exploited
PHP is now widely used. However, the risk of impact on each system depends on many factors such as the PHP version being used or the website deployment model.
The PHP development team has released a security patch (Photo: ACS).
Exploiting the vulnerability also requires sending specially crafted requests and precisely controlling the memory state. In addition, systems with web application firewalls (WAFs) capable of blocking and filtering unusual requests, if configured well, also significantly reduce the possibility of being attacked.
Therefore, determining which PHP websites are in danger needs to be evaluated for each specific system.
After the information was published, many web hosting and cloud infrastructure providers proactively updated server patches and added blocking rules on the WAF system to minimize known attack vectors.
Customers renting hosting services should contact the provider to confirm the PHP version running and patch status.
Recommendations from experts
According to recommendations from NCA, units that operate their own servers need to proactively review the entire system, making a list of servers, websites, applications and environments that use PHP, along with the running version. Many problems occur in neglected systems.
Experts recommend that units operating their own servers need to proactively review the entire system (Photo: CNN).
Besides, updating the patch, upgrading to one of the patched versions mentioned above. Note that the PHP project does not release patches for PHP 8.1 and earlier because these branches have reached the end of their support lifecycle.
In addition, units also need to minimize attack vectors through WAF and system configuration, and enhance access log monitoring.
The two vulnerabilities lie on the server running the website, not on the user's device or browser. Normal online access, searching, shopping or transactions are not directly affected, users do not need to stop using any services.
According to experts, the discovery and publication of vulnerabilities is a normal part of the technology ecosystem. What matters is that the patch is in place, service providers have begun to respond, and organizations have enough information to act. The priority now is systematic review, patching in the right order of priority and continuous monitoring, instead of worrying too much.