Useful
22.10.2026
Government institutions, organizations and online platforms in various countries have temporarily suspended their websites after the discovery of two critical vulnerabilities in PHP – a technology used by nearly 70% of websites around the world. The problem, known as PHP2Shell, poses a serious security risk to millions of web applications.
On October 21, 2026, PHP developers published emergency security updates. According to the BBC and The Guardian, among the organizations that undertook a preemptive shutdown of online services were government institutions in several European countries, local authorities in the UK, and the Wikimedia Foundation, the organization behind Wikipedia. Some of the BBC pages were also temporarily inaccessible.
In most cases, outages are a precaution as organizations review and update their systems, not evidence of a cyberattack.
What is PHP2Shell and why is the risk so high?
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been rated with a critical severity score of 9.2 out of 10 on the CVSS scale.
Under certain conditions, they allow attackers to execute malicious code on vulnerable servers without having a username or password. Potential consequences include stealing information, compromising applications, installing malware, and disrupting business services.
Particularly interesting is the fact that vulnerabilities have existed in PHP code for more than a decade, but have only now been discovered using AI-based tools. However, the same technologies can also be used by cybercriminals to speed up the development of attacks.
Using WordPress or an online store? Check if your site is protected by PHP2Shell
PHP is an essential technology for popular platforms such as WordPress, WooCommerce, Drupal, Joomla, and multiple e-commerce systems. This means that the problem can affect not only large corporate systems, but also relatively small business sites and online stores.
Even regularly updating WordPress and its plugins does not guarantee that the version of PHP used is secure. It is managed at the server level and requires separate verification.
PHP developers have released updated versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 that fix the vulnerabilities.
Organizations should check the versions of PHP used by their sites and applications and apply the necessary updates. Publicly available systems that handle customer data, payments, and other sensitive information deserve particular attention.
How does WAF protection help limit risk?
The PHP2Shell crisis once again shows the importance of multi-layered web application protection.
A Web Application Firewall (WAF) analyzes incoming web traffic and can block malicious requests, including attempts to exploit known vulnerabilities. For critical threats such as PHP2Shell, a properly configured WAF provides additional protection, especially in the period between the detection of the vulnerability and the installation of the necessary updates.
EVOLINK offers a WAF service to protect websites, online stores, and business applications. Within the day the vulnerabilities were announced, special protection rules against CVE-2026-109618 and CVE-2026-109619 were implemented in the service. They block requests specific to PHP2Shell exploitation attempts and reduce the risk to client sites while the PHP update is being implemented.
WAF is not a substitute for updating PHP, as vulnerabilities are in the runtime itself. Therefore, we recommend that our customers check the PHP version on their servers, apply updates as soon as possible, and keep WAF protection enabled as an additional layer of protection.
The case of PHP2Shell is another reminder that cybersecurity requires constant preparedness to respond. For businesses, this means not only regular software updates, but also reliable mechanisms to protect, monitor, and timely contain emerging threats.
