PHP2Shell is a test for how efficient your organisation’s security is

Last week, the internet was scrambling to address two vulnerabilities found in PHP that potentially impacted three-quarters of the world’s websites.

While a patch was rolled out relatively quickly to address these cybersecurity issues, now it is up to organisations to ensure that they are implemented, and in many cases, this incident has served as a noteworthy test for how efficient an organisation’s security truly is.

This, according to Allan Juma, lead cybersecurity engineer at ESET, who recently shared an op-ed on the matter, along with urging organisations to patch their underlying PHP runtimes and review systems to mitigate potential security breaches.

“Out of everything that was discovered and disclosed in October, PHP2Shell should serve as a warning to South African companies. The two flaws – CVE-2026-109618 and CVE-2026-109619 – can allow attackers to execute code without logging in and put all PHP installations serving web requests at risk. In practical terms, an attacker could make a vulnerable server run malicious code without first gaining authorised access,” noted Juma.

“Because the vulnerabilities are in PHP itself, not in a plug-in, theme or content management system, updating WordPress or the application doesn’t fix them. Organisations need to patch the underlying PHP runtime and restart their affected PHP services,” he advised.

Citing a recent story by TechCentral, Juma highlighted that websites belonging to government departments, metros, regulators and state-owned companies all need to focus on security elements like this, as they all depend on PHP. While no notable vulnerabilities were discovered, the scramble last week illustrated how security is a persistent issue for any organisation.

“The public sector certainly felt the pressure. On Friday 23 October, the Presidency temporarily took its website offline as a precaution and Vincent Magwenya told Reuters that there was no indication of a security breach,” wrote Juma.

“What makes PHP2Shell a warning shot is how quickly the threat has developed. Amazon said its honeypots recorded an exploit attempt on 17 October four days before public disclosure, Cloudflare reported tens of thousands of attempts within 45 minutes of disclosure, rising to the millions by 22 October. By the same day, VulnCheck researchers said they had developed an exploit that achieved remote-code execution on PHP 8.4.26 running on x86-64 systems. BleepingComputer reported confirmed exploitation with a honeypot recording successful code execution against an Apache installation,” he continued.

Moving forward, this incident now serves as an important reminder for organisations to evaluate their cybersecurity hygiene. As such, many need to take steps to ensure that are adequately prepared, if they have not done so already.

“Companies need to establish where their PHP runs and every website, portal and application that uses it, including those built by agencies or hosted by third parties. Request evidence of patch status and ask each hosting provider, developer or managed service provider to confirm in writing which applications use PHP, which builds are running and whether the relevant fixes have been applied,” he pointed out.

“Systems running PHP 8.1, or older, need a plan to move to a supported release and review logs for suspicious activity and check the application and server for unfamiliar accounts, files or changes. Threat intelligence also helps companies distinguish attempted attacks from confirmed exploitation and will help you to prioritise your response,” Juma concluded.

As we saw with CrowdStrike in 2024, much of the internet is built on technology made by a handful of companies, so any issues that they experience will have a widespread impact.

PSA: Make sure your website patches these PHP vulnerabilities

[Image – Photo by Markus Spiske on Unsplash]

Let's talk tech!

Get the tech news you want to read. Take our reader survey and tell us how we can help you better.

Take the survey now