HKCERT Warns of Critical “PHP2Shell” Vulnerabilities: Businesses Must Immediately Review and Patch PHP Systems AI Accelerates Cyber Attacks and Defence, Further Shortening the Response Window Between…

HKCERT Warns of Critical “PHP2Shell” Vulnerabilities: Businesses Must Immediately Review and Patch PHP Systems AI Accelerates Cyber Attacks and Defence, Further Shortening the Response Window Between Vulnerability Disclosure and Exploitation

Release Date: 22 Oct 2026
320 Views

(Image generated by generative AI and reviewed under professional human supervision.)

The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) reminds businesses and organisations in Hong Kong that the PHP security team has recently released emergency security updates to address two critical vulnerabilities collectively known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). Remote attackers can exploit these vulnerabilities to execute unauthorised code. Affected PHP systems must be patched as soon as possible.

HKCERT stresses that the potential risks extend beyond conventional web servers. Applications, networking and security appliances, storage systems and monitoring systems used by businesses may also have PHP embedded in their administration interfaces or operational components. These PHP versions may differ from those shown by the operating system, creating blind spots in corporate cybersecurity management. In addition to checking web servers, organisations should immediately conduct a comprehensive inventory of all products, services and externally accessible systems that may use PHP, and proactively confirm the scope of impact and patching arrangements with their suppliers.

This incident also highlights how artificial intelligence (AI) is accelerating both cyber-attacks and defence. According to publicly available information, security researchers discovered these PHP vulnerabilities using AI as early as August 2026 and reported them to the PHP team for remediation. Following disclosure of the vulnerability details, multiple cybersecurity organisations also detected large-scale scanning and attacks targeting the vulnerabilities.

AI tools are lowering the technical barriers to vulnerability analysis and proof-of-concept (PoC) code development. Once technical details are made public, attackers may also develop attack tools more quickly, further shortening the response window between vulnerability disclosure, scanning and attempted exploitation. Businesses that previously waited until security updates were released before gradually scheduling patching will face greater risks.

PHP’s Widespread Use: Businesses Must Address Hidden Risks in Devices and Systems

PHP is a widely used server-side programming language that powers numerous websites worldwide, including those using content management systems (CMS) such as WordPress, Joomla and Drupal. According to publicly available information, PHP is used by more than 75% of websites worldwide. VirusTotal estimates that more than 5.1 million PHP hosts are connected to the internet globally, of which around 3.8 million have at least one open port, making these vulnerabilities a prime target for attackers.

HKCERT reminds businesses that their inventory must go beyond identifying which PHP version their websites use. Some networking devices, security products, storage devices, monitoring platforms and other enterprise applications may use PHP in their management interfaces or internal components. If these components are excluded from routine software asset inventories and vulnerability management, security risks may remain even after the main servers have been updated.

HKCERT Urges Businesses to Take Five Immediate Actions

• Conduct a comprehensive inventory of PHP assets: Organisations should identify all systems running PHP, particularly internet-facing servers.
• Install security updates immediately: Upgrade PHP to a patched version, including PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  • Some Linux distributions, such as Ubuntu and SUSE, have already released security updates. For Ubuntu/Debian systems, run: sudo apt update && sudo apt upgrade
  • After updating, restart the relevant services, such as Apache: sudo systemctl restart apache2
  • Alternatively, restart the system to ensure the patches take effect: sudo reboot
  • After updating, use the following command and compare the installed versions against the official versions to verify that the update was successful:
    • apt list '?installed ?name(^php[0-9.]+$)'
    • Official versions: https://ubuntu.com/security/notices/USN-8948-1
  • * For details, refer to the security advisories and update guidance issued by the respective Linux distribution vendors.
• Proactively contact device and software suppliers: PHP 8.1 and earlier versions are no longer officially supported by PHP. Users should upgrade to a supported version as soon as possible or contact their distribution or long-term support (LTS) provider about patches.
• Reduce external exposure if immediate patching is not possible: Consider temporarily taking affected systems offline or isolating them from public networks to reduce the risk of attack.
• Check for anomalies or signs of compromise: Review system logs and network traffic for unusual requests, unauthorised code execution or other suspicious activity.

HKCERT urges organisations to promptly identify affected externally accessible systems running the above software, prioritise patching internet-accessible services, and check for signs of compromise. If suspicious activity is detected, organisations should immediately isolate affected systems, preserve relevant logs and initiate incident response.

For more information, please visit:

• PHP Multiple Vulnerabilities: https://www.hkcert.org/security-bulletin/php-multiple-vulnerabilities_20261022