India’s cyber security agency, CERT-In, has warned about two critical flaws in PHP, the programming language behind a large share of the world’s websites, including every WordPress site. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, could let an attacker run their own code on a vulnerable web server without logging in. PHP released fixes on 21 October, the same day CERT-In issued its vulnerability note. On 23 October it followed up with an advisory aimed at small and medium businesses.
Both flaws are rated 9.2 out of 10 for severity. Security teams, including Amazon’s threat intelligence group, have reported attempts to exploit them, some as early as 17 October, before the details were public.
Why it matters
If you run a website for a shop, clinic, school or blog, there is a good chance it runs on PHP, often on shared hosting where you never see the server settings. That is why CERT-In issued a separate advisory for small businesses, which usually depend on a hosting company or developer to apply updates. For visitors, nothing changes unless a site is compromised, but a hacked site can be used to steal form data or spread malware.
What you can do
- Ask your hosting provider or developer which PHP version your site runs, and whether it has been updated to a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Ask for the answer in writing rather than assuming.
- Treat PHP 8.1 or older as urgent. These versions have no regular fixed release, and the US cyber agency CISA has advised taking such systems offline until they are upgraded.
- Keep a recent backup, restrict who has admin access, and review recent logins and changes if anything looks unusual.
- A web firewall can block some attacks, but updating PHP is the only complete fix.