Key Takeaways
- Two significant RCE vulnerabilities, referred to as PHP2Shell, could enable attackers to execute harmful code on compromised servers.
- PHP underpins nearly 70% of all websites, though the precise number of vulnerable installations remains uncertain.
- The PHP development team plans to issue patches soon, prompting administrators to act swiftly to update their systems.
- According to CERT-EU, organizations that cannot implement patches promptly should consider isolating public-facing applications.
On Tuesday evening, administrators of WordPress sites, e-commerce platforms, and various business applications received urgent advisories to prepare for critical security updates following the discovery of two serious vulnerabilities, which have raised alarms about potential widespread cyber intrusions.
These vulnerabilities, which impact PHP—the programming language that powers a majority of the internet’s most substantial platforms, including WordPress, Drupal, Joomla, and Magento—are classified as remote code execution (RCE) flaws.
If exploited, they could allow hackers to execute malicious scripts on affected servers. This could result in theft of sensitive customer information, deployment of malware, or even the crippling of websites.
While the exact number of vulnerable installations is still unknown, a recent report from Censys indicated that merely 14% of publicly accessible WordPress sites had received the latest security updates.
When Will the PHP Security Patches Be Released?
The PHP security team has announced that patches addressing the two vulnerabilities, each rated at 9.2 for severity, will be made available at 3 PM (UK time) on Wednesday, October 21st.
“All PHP users are encouraged to make preparations to upgrade as soon as the release occurs,” stated PHP.
System administrators, hosting service providers, and developers are being urged to assess their PHP configurations, verify software versions, and be ready to implement the necessary fixes at the earliest opportunity.
Additionally, the European Union’s Computer Emergency Response Team (CERT-EU) has advised organizations unable to patch affected systems to consider taking them offline.
In its advisory issued on Tuesday, CERT stated:
Currently, no technical specifics are publically available. CERT-EU strongly recommends that organizations prepare to apply patches to affected assets immediately.
Where patching is not immediately possible, organizations should consider isolating internet-exposed applications from public networks until remedies are accessible, the advisory cautioned.
What Can WordPress Website Owners Do Now?
The vulnerabilities, cataloged in leaked documents as CVE-2026-109618 and CVE-2026-109619, were identified prior to their scheduled disclosure, with the security firm watchTowr disseminating information on its website.
Security researchers have begun to label these flaws as “PHP2Shell.” Meanwhile, discussions regarding interim protective measures have surfaced on X.
Security analyst Andrew Dorman (@acd421) suggested disabling PHP’s session.upload_progress feature and enacting restrictions on unnecessary file uploads based on his source code analysis.
However, he also cautioned that his assessment was of “moderate confidence, NOT officially verified,” underscoring the importance of adhering to official guidance upon its release.
Another developer, known as Mostly Gino, encouraged teams to examine forgotten PHP installations, particularly those bundled within outdated Docker images, vendor devices, and neglected WordPress subdomains. “…anything running PHP 8.1 or older is already end-of-life, so no official changes will be forthcoming for those versions,” they remarked on X.
“Organizations should prepare for prompt patching and remain vigilant of PHP’s official security updates to apply them as soon as they are available,” he advised Cybernews.
The directive is to inventory PHP installations, identify those utilizing end-of-life software, and give priority to internet-facing systems for review and remediation once affected versions are confirmed,
said Saeed Abbasi, head of Threat Research Unit at Qualys.
“PHP 8.1 and earlier iterations are no longer supported by the upstream PHP project, rendering these systems a focal point for upgrade strategies,” he further stated.
Having been introduced in 1995, PHP remains integral to the majority of web infrastructure; thus, a fundamental flaw could have ramifications for an array of entities, from small enterprises to large corporations.
In contrast to current exploits, which have yet to be validated within PHP, recent cyber incidents have seen attackers successfully exploiting two zero-day vulnerabilities in other software.
The UK’s National Cyber Security Center has now issued a notice encouraging organizations to prepare for immediate PHP updates and to contemplate taking vulnerable systems offline if they cannot be secured in a timely manner.
We will continue to update this story as more information about the patches becomes available.
Recent Updates:
A Belgian hosting provider, Hosted Power, has developed an open-source PHP extension to close known pre-application attack vectors on servers that remain unpatched.
The company emphasizes that the php_uploadprogress_guard serves merely as a temporary fix, with only the official update providing a comprehensive resolution.
Patrick Münch, chief security officer at Mondoo, commented that the forthcoming PHP fix is anticipated to address only versions 8.2 through 8.5, thereby leaving older versions, such as 7.4, 8.0, and 8.1, without any available patch.
While everyone is focused on the patch at 14:00 UTC, it is crucial to note that only PHP 8.2-8.5 will receive an update.
For those using 7.4, 8.0, or 8.1, no patch will be provided, Münch cautioned, adding that organizations that do not require upload progress bars should disable session.upload_progress.enabled in php.ini as a precautionary measure.
PHP has rolled out fixes for the vulnerabilities identified in versions 8.2 to 8.5. According to PHP, the vulnerabilities could allow attackers to execute code on servers without requiring authorization.
“Updates are the only secure option, as complete mitigations are not feasible,” states PHP, urging organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 at the earliest opportunity.
Systems running Apache with mod_php face heightened risk, as attacks can be initiated before any application code is executed.
Older versions, including 8.1 and earlier, will not receive an official patch, but PHP has released source code backports for versions 7.4, 8.0, and 8.1.
Exploits for the newly discovered PHP vulnerabilities are already circulating online, with complete code available for download.
These exploits were published mere hours prior to the patch release. The author of one technical analysis indicated that the exploit was successfully tested in both laboratory and real-world environments, dubbing one of the flaws “weaponized” in their experiments.
Additionally, a report from Calif, the entity claiming initial discovery of the flaws, has resurfaced.
Source link: Cybernews.com.
