Security agencies in the United States and the United Kingdom have told organisations to patch two critical flaws in PHP immediately, or take affected systems offline until they can. The vulnerabilities, collectively called PHP2Shell, sit in the programming language that runs a large share of the web.
What PHP2Shell is
PHP2Shell covers two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity score of 9.2 out of 10 and allow remote code execution, meaning an attacker can run their own commands on a vulnerable server.
The flaws are in PHP itself, not in a plugin or a particular website. According to the PHP security team, PHP can be left with corrupted memory when a request ends abnormally, and attackers can exploit that state. One flaw involves out-of-memory corruption, while the other involves leftover global state that allows memory access after it should have been cleared.
Why experts are alarmed
An attacker needs no login credentials. The PHP team says the risk is highest on servers running Apache with mod_php, where a demonstrated exploit lets a single unauthenticated request trigger the attack before any application code runs. That means security features built into frameworks and content management systems offer little protection at that stage.
PHP is widely estimated to power well over two-thirds of websites, including WordPress, Drupal and Joomla. One exposure estimate puts more than 5 million PHP hosts online.
How it was found
Researchers from Calif, Wiz and OpenAI discovered the flaws, with AI tools helping the search. Reports say the underlying weakness had gone unnoticed for years. Security professionals say the case shows how fast the gap between disclosure and exploitation is closing, as defenders and attackers both use AI to find bugs.
The official response
PHP warned administrators a day ahead to prepare for emergency updates, then released the patches on October 21, 2026. The US National Security Agency and the UK National Cyber Security Centre advised organisations that cannot patch quickly to consider taking exposed systems offline. America’s cyber agency, CISA, also urged immediate patching. Cloudflare added protective rules and said it had already seen early attack attempts.
What administrators should do
The fixed versions for PHP 8.x are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive official updates. Some operating system vendors provide backported fixes, and the PHP team released limited source backports for versions 7.4, 8.0 and 8.1 for those who build from source. Anyone on PHP 7 or earlier should move to a supported release.
For those who cannot patch at once, PHP published temporary measures, such as tightening memory and upload limits and disabling upload progress tracking. Experts stress these reduce exposure but do not fully block attacks. Applying the official patch is the only lasting fix. Because PHP is often bundled inside other software and appliances, organisations should also check for hidden dependencies.
What it means for African businesses
Many Nigerian and African banks, e-commerce stores, media sites and government portals run on PHP, often through WordPress. Site owners should confirm their PHP version with hosting providers and apply updates this week. Some managed WordPress hosts have said their customers are already protected and need to take no action.
For ordinary users
There is nothing to install on a phone or personal computer. The risk lies with the servers behind websites. Users may meet sites in maintenance mode as administrators patch, and should be cautious about entering sensitive information on sites that appear unpatched or behave oddly.
