PHP, a technology behind many websites and web applications, is being actively targeted through two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619, collectively dubbed “PHP2Shell”.
PHP has now released security updates. Businesses should identify affected systems and patch promptly, prioritising internet-facing services.
What’s happened
Details of the two PHP vulnerabilities were leaked online before the PHP project had released its fixes or full security guidance, giving attackers a head start on defenders. Proof-of-concept exploit code began circulating in the early hours of 21 October, several hours before official patches were published that afternoon. Amazon Threat Intelligence has reported an attempt as early as 17 October, four days before public disclosure. Because PHP powers a large share of the world's websites and web applications, this left a significant number of organisations exposed before they had the information needed to patch.
Both vulnerabilities, with a CVSS v4.0 severity score of 9.2, could let attackers run malicious commands on affected servers without valid login credentials.
However, research suggests the vulnerabilities can’t be exploited in every PHP environment. An attack requires specific conditions or knowledge of the target server, making widespread, indiscriminate exploitation less likely than first feared. Where those conditions are present, however, the risk remains serious.
Why this matters
If exploited, PHP2Shell could give an attacker an initial foothold on a vulnerable web server. What happens next will depend on how that server is configured, the privileges available to the compromised service and how it connects to the wider environment.
Potential follow-on activity could include:
Deploying malware
Stealing login credentials
Accessing or encrypting sensitive data
Establishing persistent access to the server
Escalating privileges
Moving laterally into other systems
Exploitation does not automatically mean an attacker will gain control of an organisation’s wider network. They would typically need to take further steps to cause more serious compromise. This gives businesses an important opportunity to identify and patch vulnerable PHP installations before that access can be used to cause wider damage. However, patching alone may not be enough if a system has already been compromised. Organisations should also check affected systems for suspicious activity or signs that an attacker has established persistent access.
Who could be affected?
Any organisation using a vulnerable PHP version or configuration could be exposed, including through hosted websites, applications, appliances or network devices. PHP powers approximately 69.7% of websites whose server-side programming language is known.
What should businesses do?
-
Identify affected assets
Check your security and asset-management tools: Search vulnerability scanners, endpoint platforms and software inventories for “PHP”. Tenable, Qualys, Rapid7 and Microsoft Defender may identify installations and versions.
Check Linux servers: Ask your infrastructure team to check installed software and packages, or run this command to identify the PHP version: [php -v].
Check your websites and applications: Ask your web or application team whether you use PHP, particularly through WordPress, Drupal, Magento or Adobe Commerce, and Laravel.
Contact hosting providers and other third parties: Ask hosting providers which PHP versions and configurations your services use. Check with software and device vendors for embedded PHP and available updates.
Prioritise internet-facing systems: Focus first on publicly accessible websites, applications and management interfaces, which are more directly exposed to attackers.
-
Apply available security updates
Upgrade affected PHP installations promptly. For PHP embedded in software or appliances, follow vendor guidance and apply updates when available.
-
Check for signs of compromise
Review alerts, logs and affected servers for unusual behaviour or unauthorised access. Use endpoint detection and response tools where available.
If you identify suspicious activity, involve your IT security or incident response team, or contact CFC’s incident response team.
For brokers
Encourage clients to share this checklist with their IT teams and providers, even if they do not knowingly use PHP. It may sit behind their website or be embedded in services managed by third parties, so clients should not assume they are unaffected.
The key message is to check exposure and act promptly, without assuming that a potentially vulnerable system has been compromised. Clients who identify suspicious activity should contact their IT security team or CFC’s incident response team for support.
CFC monitoring & support
CFC has completed its largest exposure-matching exercise to date to proactively notify potentially affected insureds. Our cyber security and incident response teams continue to monitor the threat and investigate links between detected exposure and reported incidents.
If you have questions or require support, contact CFC’s cyber response team through the Response app, our website or at customersupport@cfc.com.
