TOKYO/BEIJING | October 22, 2026 | Millions of attempts to exploit critical software vulnerabilities have triggered a global cybersecurity alert, as companies and government agencies race to protect websites and online services powered by PHP, a programming language used across the internet.
Cloudflare, a major internet infrastructure and cybersecurity company, reported a surge in attack traffic after details of the vulnerabilities became public. The incident has raised concerns worldwide because the flaws could allow attackers to execute malicious code on vulnerable servers without logging in.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, were disclosed on October 21. According to the European Union Agency for Cybersecurity (ENISA), the European Commission, CERT-EU, Europol’s European Cybercrime Centre and national cybersecurity response teams, the flaws require immediate action from organizations operating affected systems.
PHP is used by nearly 70% of websites, according to Cloudflare, and supports widely used platforms such as WordPress and Magento. Because the vulnerabilities affect the PHP runtime itself, updating a website’s content management system or plugins alone will not resolve the problem. The underlying PHP software must also be updated.
The PHP development team released security fixes for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The Canadian Centre for Cyber Security urged organizations to identify affected installations, prioritize systems accessible from the internet and apply the updates immediately. Older PHP versions that no longer receive direct support may require fixes from software vendors or hosting providers.
The European cybersecurity agencies also advised organizations to coordinate with their service providers and consider isolating exposed applications from public networks if immediate patching is not possible. Administrators should monitor server and application logs for suspicious activity and investigate signs of unauthorized access.
The incident illustrates the global consequences of vulnerabilities in widely deployed software, particularly when technical details become available to potential attackers. However, reported exploit attempts do not necessarily mean that attacks succeeded or that every website using PHP is vulnerable.
Website owners and administrators are urged to verify their PHP versions with their hosting providers and confirm that security updates have been installed.
Si Venus L Peñaflor ay naging editor-in-chief ng Newsworld, isang lokal na pahayagan ng Laguna. Publisher din siya ng Daystar Gazette at Tutubi News Magazine. Siya ay isa ring pintor at doll face designer ng Ninay Dolls, ang unang Manikang Pilipino. Kasali siya sa DesignCrowd sa rank na #305 sa 640,000 graphic designers sa buong daigdig. Kasama din siya sa unang Local TV Broadcast sa Laguna na Beyond Manila. Aktibong kasapi siya ng San Pablo Jaycees Senate bilang isang JCI Senator.
- Venus L Peñaflor
- Venus L Peñaflor
- Venus L Peñaflor
- Venus L Peñaflor
