What is PHP and why did it spark a global cyber-security scramble?

What is the issue?

PHP is the software that runs a huge share of the world's websites, including WordPress, Drupal and Joomla. Researchers found two serious flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). Think of it like a lock fault in the building, not in one office. An attacker can send a specially crafted request to a website and, without any password, take control of the server behind it. They could steal data, read passwords, deface the site or use it to reach other systems. Because the fault is in PHP, even a well-built website can be exposed. The fix was released on 21 October 2026, and there are already reports of attacks.

How each organization has responded?

1. Wiz Research found these flaws. Wiz is a cloud security company, and its research team

discovered the first bug in August 2026, reported it to the PHP team, and worked with them

on a coordinated fix and public disclosure on 21 October. Wiz explained how the flaws work,

showed they can be exploited on WordPress, Drupal and Joomla, and shared signs to watch

for, such as repeated server errors and unusually large session cookies. Their remedy:

update PHP.

2. CERT-In, India's national cyber agency, rated it Critical, says large-scale attacks are being

reported, and urges everyone to apply PHP's security update immediately.

3. DSCI (a Nasscom initiative) published the most complete checklist: find every PHP install,

update, restart the server, rebuild containers, and check internet-facing systems for signs of

a break-in. It also lists temporary settings that help but do not fully protect.

4. A leading global American-Japanese cybersecurity software company shared a checklist for

spotting compromise, such as web shells and unusual outgoing connections, and released

detection rules for its own security products.

5. A leading vulnerability and exposure management company released scanner checks to find

vulnerable PHP across an organization, since PHP often hides inside other software.

6. A cybersecurity company specializing in application and network protection is offering a 7-

day free trial of its web application firewall, which can block some attack attempts while you

patch.

The solution, in short

• Everyone agrees: update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, then restart the server. Updating is the only complete fix

• Older PHP versions (8.1, 8.0, 7.4) get only special backported fixes, and anything older has no fix, so upgrade it

• The security products from the three vendors above can reduce risk in the meantime, but they are a stopgap, not a replacement for patching

What should smaller organizations and MSMEs do?

1. Ask your website developer or hosting provider today: "Have you updated PHP for the October 2026 security flaw?" 

2. If you use WordPress or another CMS, ask what PHP version your site runs and make sure it's a fixed one

3. If your provider can't patch, plan to move the site or take it offline until it's fixed

4. Check for warning signs: unknown files, a slow or crashing site, odd admin accounts, or strange outgoing traffic

5. Change important passwords and keys if you suspect the site was exposed before patching

6. You don't need to buy anything to be safe. Patched software and the free advisories from CERT-In and industry bodies are the real help. Trials and paid tools are optional extras

A note: several vendors are also promoting their products here. That's normal, but it's worth remembering that none of them replace the update.

Sources: Wiz Research (wiz.io/blog/php2shell-php-rce), CERT-In CIVN-2026-0510, PHP security release notes, and public advisories from the other organizations above.