CERT-PH Urges Immediate Patching of Critical PHP Vulnerabilities

The National Computer Emergency Response Team of the Philippines has issued an urgent advisory instructing government agencies, critical infrastructure operators, and hosting providers to immediately patch two critical remote code execution vulnerabilities affecting PHP. Collectively tracked as CVE-2026-109618 and CVE-2026-109619 and widely referred to as PHP2Shell, these severe flaws carry a Common Vulnerability Scoring System score of 9.2 and permit unauthenticated hackers to take full control of vulnerable web servers without requiring a password.

The vulnerabilities stem from critical memory-handling flaws, including memory exhaustion cleanup errors and use-after-free bugs that leave broken data or stale references exposed for arbitrary code execution. Following public proof-of-concept availability and early exploitation attempts observed by security researchers, PHP developers rushed out emergency security updates on October 21, 2026, covering versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CERT-PH emphasizes that updating content management systems such as WordPress, Drupal, or Joomla is insufficient on its own, as administrators must directly patch the underlying PHP runtime, with Apache mod_php installations facing the highest risk of premature exploit triggers.

Although no confirmed local compromises have been established in the Philippines, the widespread availability of public testing tools significantly lowers the barrier for potential attackers. Organizations are strongly advised to audit outsourced and managed hosting systems, upgrade unsupported legacy PHP versions, and deploy emergency patches to protect public-facing online services and sensitive memory data. Prompt remediation remains essential for preventing widespread service disruptions and shielding the nation’s digital ecosystem from unauthorized intrusions.