PHP2Shell flaws prompt security alerts as security firms report attacks

Insurance Business reported on 22 October that two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell", had set off security alerts in Asia-Pacific and elsewhere, and that some security firms were already seeing attacks. PHP's maintainers released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC on 21 October. Each flaw has a severity score of 9.2 out of 10. According to the Canadian Centre for Cyber Security, an attacker who has not logged in could use them to run code on an affected server.

For older versions the position is less simple. The Canadian centre states the normal support rule: PHP 8.1 and older no longer receive updates from the PHP project, and the official fixed releases cover only 8.2 to 8.5. In an update to its report, Insurance Business said PHP had nevertheless published patched source code for 7.4, 8.0 and 8.1, and that Red Hat and AlmaLinux had backported fixes to retired PHP streams. Sites on those versions now have a way to patch, but not a simple update to install.

Reports on exploitation differ. According to the same Insurance Business report, watchTowr recorded exploit attempts against its decoy servers, Hadrian and Patchstack reported active exploitation and Cloudflare saw early attacks, while CISA and Huntress said on 21 October that they had not observed exploitation. In its update of 23 October, the Canadian centre still reported no active exploitation but warned that this "can change quickly". The same update added a third flaw, CVE-2026-115560, which has no fix yet; the interim step is to turn off PHP's session upload progress feature.

Several public bodies took sites offline as a precaution. Government agencies in the Netherlands, Finland and France did so, as did parts of Wikipedia, and the Australian Cyber Security Centre issued its highest-level alert, Insurance Business reported. No victim had been named.

For cyber insurance, the publication expects brokers to receive business interruption questions from clients that shut sites down voluntarily, because few policies explicitly cover such shutdowns. Contingent business interruption cover for shared hosting is not standard and is often sub-limited, and underwriters may ask how quickly clients patched. The flaws arrive in a soft market: Marsh data cited in the article show global cyber rates fell 4% in the third quarter, the thirteenth consecutive quarterly decline.

The Canadian centre advises immediate updates, starting with internet-facing systems, checks on third-party products that bundle PHP, and a review of logs for signs of compromise.