Study OAS ·
PHP2Shell Vulnerabilities Trigger Global Cybersecurity Alerts
What’s the News?
- Two critical security vulnerabilities, collectively known as PHP2Shell, have triggered global cybersecurity alerts, potentially exposing millions of websites and internet-facing services.
- Identified as CVE-2026-109618 and CVE-2026-109619, the flaws allow hackers to execute malicious code remotely without authentication.
- The PHP Foundation has released emergency security updates, while cybersecurity agencies, including India's CERT-In, have advised organisations to patch vulnerable systems immediately.
PHP2Shell Vulnerabilities?
- Affected Technology: PHP (Hypertext Preprocessor), an open-source, server-side scripting language widely used in web development.
- Vulnerability Identifiers:
- CVE-2026-109618: Memory corruption caused by improper handling of out-of-memory conditions.
- CVE-2026-109619: Improper management of internal memory references, resulting in use-after-free vulnerabilities.
- Severity: Both vulnerabilities received a CVSS v4.0 score of 9.2/10 (Critical).
- Impacts:
- Unauthenticated Remote Code Execution (RCE).
- Theft of passwords, authentication tokens and API keys.
- Unauthorised access to web servers and sensitive information.
- Affected Platforms: PHP-based applications, including WordPress, Drupal, Joomla and Magento.
Global Cybersecurity Impact
- Censys Assessment: Approximately 3.67 crore internet-facing services were identified as reporting potentially affected PHP versions.
- Qualys Assessment:
- Identified 16.7 crore PHP package installations across its analysed environments.
- Around 73% of installations with known PHP versions were on internet-facing assets.
- Approximately 11 crore installations used unsupported PHP versions.
- India's Exposure:
- India ranked 9th globally, with approximately 53,400 internet-facing services displaying PHP information in a CloudSEK analysis.
- Around 36,100 of 36,700 Indian services disclosing PHP version details were identified as unpatched.
Security Measures
- Emergency Updates: The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- Recommended Actions:
- Upgrade to supported PHP versions.
- Prioritise internet-facing web servers.
- Monitor system logs for suspicious activity.
- Restrict access to vulnerable services until remediation is completed.
- Unsupported Versions: PHP 8.1 and earlier versions require appropriate vendor-supported fixes or migration to supported releases.
Additional Info
- CERT-In (Indian Computer Emergency Response Team):
- Established: 2004.
- Nodal Ministry: Ministry of Electronics and Information Technology (MeitY).
- Designated as the national agency for responding to cybersecurity incidents under Section 70B of the Information Technology Act, 2000.
- CVE (Common Vulnerabilities and Exposures):
- A standardised identification system for publicly disclosed cybersecurity vulnerabilities.
- CVSS (Common Vulnerability Scoring System):
- An internationally recognised framework for assessing vulnerability severity.
- Uses a numerical score ranging from 0 to 10.
- Remote Code Execution (RCE):
- A security vulnerability enabling attackers to execute commands or malicious programs on a remote system.