Cyber Swachhta Kendra: PHP2Shell alert, updates urged

Cyber Swachhta Kendra has warned that two vulnerabilities known as PHP2Shell could let remote attackers run code on affected PHP systems and potentially compromise them completely. Its alert urges organisations and individuals using PHP to apply security updates urgently, saying multiple reports confirm large-scale exploitation.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, identifiers used to distinguish publicly disclosed security flaws. PHP released fixes on 21 October 2026, according to Datadog Security Labs. The US Cybersecurity and Infrastructure Security Agency, CISA, identifies PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the updated versions organisations should install.

There is a difference in the agencies’ accounts of exploitation. While Cyber Swachhta Kendra reports attacks, CISA says it had not observed successful exploitation at the time of its publication. Neither alert’s publication date is established in the available text, so those statements cannot be placed in a reliable sequence.

A flaw beneath the website’s own code

Cyber Swachhta Kendra describes PHP as an open-source scripting language used to create dynamic webpages on servers. Its alert attributes the vulnerabilities to memory corruption and improper resource control, and says an attacker could exploit them through a specially crafted request.

CISA describes the potential attack as unauthenticated remote code execution: an attacker could make the server run code without first signing in. It says all PHP installations serving web requests are at risk, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. These are different ways of running PHP to process web traffic.

According to CISA, PHP considers Apache with mod_php the highest-risk configuration. Datadog Security Labs provides a concrete example of why application-level protections may not be enough: in its laboratory reproduction, a malicious request triggered code execution before reaching the target application’s code.

Wiz Research, which reported discovering the flaws, says it demonstrated remote code execution against WordPress, Drupal and Joomla deployments using their latest container images at the time of testing. Those demonstrations do not establish that every installation of those products has been compromised. Wiz says the applications were representative test targets, while the vulnerable code resides in PHP itself.

The distinction matters for remediation. The researchers’ PHP2Shell information site says updating an application does not update the underlying PHP runtime, the software that executes its code. A website can therefore have up-to-date application code while still relying on an affected PHP installation.

What goes wrong in memory

Datadog Security Labs explains that both vulnerabilities involve PHP treating incomplete or outdated internal information as valid after an error interrupts processing.

For CVE-2026-109618, an out-of-memory error can interrupt an operation before PHP has finished preparing its internal data. The danger arises during cleanup, when PHP may act on that unfinished data. Datadog says its reproduction caused an attacker-controlled command to run at this stage.

CVE-2026-109619 concerns information left behind across requests. A PHP worker, a process that handles incoming requests, may serve many requests during its lifetime. Datadog explains that if PHP releases memory belonging to one request but retains a reference to it, a later request can cause the worker to use memory that is no longer valid.

The consequences are not limited to executing commands. Wiz says it also demonstrated disclosure of sensitive process memory without first achieving remote code execution. Such memory may contain credentials and authentication tokens belonging to other requests or to the server, according to its research.

Wiz dates its first discovery to 19 August 2026 and says it reported the vulnerabilities to the PHP security team on 24 August. These are the company’s account of its research and disclosure process, separate from the subsequent security alerts and reports of attacks.

Exploitation reports and the limits of detection

Datadog Security Labs says that, as of 21 October, it had received multiple reports of active exploitation and was aware of broad, untargeted scanning. That supports reporting that attacks had been reported, but does not supply a count of compromised systems or identify victims.

CISA’s statement that it had not observed successful exploitation is narrower than a finding that no attacks occurred. The available accounts differ in what their authors reported observing or learning; they do not establish the overall scale of compromise.

CISA says it updated its alert to add a SIGMA detection rule, a rule intended to help defenders identify potentially suspicious activity in logs. The agency also incorporated partner resources and reinforced its mitigation guidance.

Detection has limits, according to Datadog’s testing. Its successful laboratory exploit did not need to crash the PHP worker and returned an HTTP 200 response, a status normally associated with a successfully handled request. Neither a functioning server nor an apparently successful web response therefore ruled out exploitation in that test.

Wiz identifies unusual requests followed by memory-limit errors, malformed session cookies and unexplained worker restarts as possible investigation signals. The researchers’ PHP2Shell site cautions that such signals do not establish exploitation on their own, and their absence does not establish that a system is unaffected.

Updates beyond the main server installation

CISA urges immediate installation of the fixed PHP releases. Datadog says older PHP branches are also affected: although PHP 8.1 and earlier are outside normal project support, the PHP security team supplied source backports for PHP 7.4, 8.0 and 8.1. These adapt fixes for older branches; availability of packaged updates depends on the relevant vendor.

Datadog also warns that the PHP version available through a server’s command line may differ from the version serving its website. Its guidance includes checking containers and applications that bundle their own PHP interpreter, rather than treating one installation as a complete inventory.

Cyber Swachhta Kendra directs users to PHP’s security updates and mitigations. The researchers’ PHP2Shell guidance says temporary configuration changes can reduce exposure to particular attack paths but do not replace the security update; it also calls for restarting the relevant services and long-running workers after installing a fixed runtime.