PHP Flaws Shut Government Websites

By June Ramli

Editor’s note (updated Oct 23, 2026): This article has been updated to include comments from Jiří Kohout of Check Point Software Technologies, and photographs of Don Smith, Chris Yule and Jiří Kohout.

Perth, Oct 22: Organisations in Australia and Malaysia are being urged to act quickly after two critical flaws were discovered in PHP, a programming language that powers a large share of the world’s websites.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed “PHP2Shell”, each carry a severity score of 9.2. They could allow attackers to run malicious code remotely on affected web servers without logging in.
The PHP development team released emergency security updates on October 21. In Europe, government agencies in the Netherlands and Finland were among those that temporarily disabled websites as a precaution against potential attacks.
Subhajeet Singha, Senior Researcher at the Acronis Threat Research Unit, said the flawed code dates back to PHP 5.4, released in 2012.
That means “virtually every PHP installation deployed over the past 14 years is in scope,” he said.

Australia: government websites taken offline

Singha said Australia’s exposure was amplified by the federal government’s reliance on GovCMS, a Drupal-based platform that runs on PHP and hosts more than 300 Commonwealth websites.
The Australian Signals Directorate’s cyber.gov.au website was among those affected by the security issue, according to ABC News reporting on the agency’s response.
In a statement issued on October 22, the NSW Government confirmed that some state government websites had been temporarily taken offline as a precaution while security patches and updates were applied.
Cyber Security NSW is working with government departments and agencies to address potentially affected websites.
The NSW Government said no state government agencies had reported information breaches to Cyber Security NSW in connection with the incident.

Malaysia: hidden exposure a concern

For Malaysian organisations, the main risk may be systems their IT teams do not know are running PHP.
Don Smith, VP of Threat Intelligence at the Sophos Counter Threat Unit, said finding every PHP instance was a major challenge.
“The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” he said.
Chris Yule, Senior Director of Threat Research at the Sophos Counter Threat Unit, said older systems and appliances posed a particularly difficult problem because they often cannot simply be updated or replaced.
“Appliances in particular can be a black box within an organisation’s environment, with limited visibility into patch levels and software versions and organizations often dependent on the vendor for an update,” he said.
“Organisations also need to identify where affected systems and appliances are still running. Otherwise, there is a very real risk that attackers find them before defenders know they’re there.”
Organisations running WordPress, Drupal or Joomla cannot rely on updating those platforms alone if the underlying PHP installation remains vulnerable.
Martin Riley, Chief Technology Officer at Bridewell, warned that “WordPress automatic updates will not fix the underlying PHP runtime.”

Researchers report differing levels of attack activity

Singha said exploitation began before the flaws were made public.
He cited Amazon honeypot data showing an exploitation attempt on October 17, four days before disclosure, and said details of the vulnerabilities had leaked on social media on October 20.
Jiří Kohout, Cyber Risk and Security Strategist at Check Point Software Technologies, said the premature leak “gave attackers a head start”, and that screenshots of a PHP2Shell attack tool had already begun to surface.

“Organisations should operate under the assumption that opportunistic scanning of their PHP infrastructure is already underway,” Singha said.
Singha expects attack activity to escalate rapidly across the Asia-Pacific region.
Other cybersecurity organisations have reported differing levels of activity within their monitoring environments.
Huntress said it had not observed exploitation across its monitored systems at the time of its assessment, while acknowledging reports from other researchers.
The Dutch National Cyber Security Centre also initially reported that it had not identified active exploitation.
However, Amazon Threat Intelligence and watchTowr have reported exploitation attempts, highlighting how visibility can vary between monitoring networks and reporting periods.

AI speeds up the attack cycle

US security firm Calif used OpenAI’s models to help turn existing theoretical research on PHP’s memory handling into a working exploit.
“AI didn’t invent a new class of bug; it accelerated the process of validating and weaponizing a known theoretical weakness,” Singha said.
Yule said Sophos research supported findings that the techniques could predictably corrupt memory and bypass some implementations of address space layout randomisation, a security protection designed to make memory attacks more difficult.
“With AI accelerating the weaponization process, attackers can potentially move to working exploits much faster, leaving defenders with an increasingly narrow window to respond,” he said.
Smith said threat actors were likely to make PHP a priority target “over the coming hours and days.”

What organisations should do now

The PHP development team released four patched versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
PHP 8.1 and earlier are no longer supported through the project’s regular security update cycle, although some software vendors and Linux distributions provide backported security fixes for older releases.
Kohout said website owners should contact their administrator or hosting provider as soon as possible to confirm the patch had been applied. After updating, the relevant services should be restarted and checked to verify they are running the patched version, he said.
Acronis and Sophos advised organisations to prioritise internet-facing systems and identify affected PHP installations across their networks.
Where immediate patching is not possible, organisations should consider isolating vulnerable systems from the internet or temporarily taking affected services offline.
“A temporarily unavailable website is better than a compromised one,” Singha said.
Smith urged security teams to monitor PHP and web-server processes for unusual activity, unexpected command execution and other indications of compromise.
Kohout warned that patching would not undo an attack that had already taken place.
“Installing the patch alone will not remove any damage or malicious code that attackers may have left on the server,” he said.
He said warning signs included unexplained outages, new PHP files, unusual requests, suspicious command execution and server connections to unknown addresses.
Singha also advised organisations to consider rotating passwords, API keys and other credentials where vulnerable systems may have exposed sensitive information.
Kohout said tools that block dangerous requests, along with limiting communication between servers and the rest of the corporate network, could reduce the impact of a breach.
“These measures help buy time, but they are no substitute for updating PHP itself,” he said.