PHP2Shell flaws put websites at risk; CERT-In urges urgent patching

The brief in 5 cards

1. Note1 / 5

   WHY IN NEWS?

   • On 20 October 2026, the PHP security team announced an emergency release for two critical vulnerabilities.
   • Fixes came out on 21 October for supported versions 8.2 to 8.5.
   • The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were nicknamed PHP2Shell.
   • Both received a severity score of 9.2 out of 10 under CVSS v4.0.
   • CERT-In issued an advisory, including guidance for MSMEs. Agencies in the EU, the US and elsewhere also issued warnings.
2. Note2 / 5

   WHY IT MATTERS

   • Scale: PHP runs a large share of websites, including many built on popular content management systems.
   • Remote access: The flaws could let an attacker run commands on a server without a password.
   • Data at risk: A compromised server can expose customer records and stored credentials.
   • Visitors at risk: Attackers can plant malicious scripts or redirect users to fake pages.
   • Early activity: Amazon reported an exploitation attempt on 17 October, before public disclosure. Reports of successful breaches are unconfirmed.
3. Note3 / 5

   KEY CONCEPTS

   1. What is PHP?

   It is an open-source scripting language that runs on web servers to build dynamic websites. A flaw in PHP itself can affect sites even if their own code is secure.

   2. What are CVE and CVSS?

   A CVE is a unique ID for a publicly known security flaw. CVSS scores a flaw's severity from 0 to 10; 9.0 and above is "critical".

   3. What is remote code execution?

   It means an attacker can make a computer run their commands from afar. It is among the most serious kinds of flaw.

   4. What is CERT-In?

   The Indian Computer Emergency Response Team is the national agency for responding to cyber incidents. It works under the IT Act, 2000, and the Ministry of Electronics and IT.

4. Note4 / 5

   THE CHALLENGES

   • Slow patching: Old or forgotten PHP installations often go unpatched.
   • Unsupported versions: Many sites run PHP versions that no longer receive fixes.
   • Small firms: MSMEs often lack staff to find and fix vulnerable systems.
   • Firewalls are not enough: Web filters help but cannot replace patching.
   • Open-source upkeep: Widely used free software depends on limited maintainers and funding.
5. Note5 / 5

   WAY FORWARD

   These are suggested measures, not approved policy.

   • Patch now: Update all PHP installations and replace unsupported versions.
   • Check for intrusion: Review logs, isolate suspect systems and change exposed passwords.
   • Layer defences: Use least-privilege access, network segmentation, backups and multi-factor login.
   • Support MSMEs: Expand CERT-In outreach and simple patching guides for small businesses.
   • Report breaches: Notify affected users and authorities as required under data protection law.

Swipe or use ← → to move between cards.