New Delhi/London, October 24: The CERT-In PHP2Shell alert has triggered an urgent cybersecurity warning for Indian website operators, as authorities in India and the United Kingdom call for immediate security updates following the discovery of two critical vulnerabilities in PHP, the programming language used by millions of websites worldwide.
India’s Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology, issued vulnerability note CIVN-2026-0510 on October 21, identifying serious security weaknesses that could allow remote attackers to execute malicious code on affected servers.
The warning was reinforced by the United Kingdom’s National Cyber Security Centre (NCSC), which issued its own advisory on the same day, urging organisations to identify vulnerable PHP installations, apply security patches and examine exposed systems for possible compromise.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been assigned critical severity ratings of 9.2 under the CVSS 4.0 scoring system.
The security threat is particularly significant because the flaws affect PHP itself rather than an individual website plugin, theme or content management system.
What Is PHP2Shell and Why Is It Dangerous?
PHP2Shell refers to two critical vulnerabilities involving memory corruption and improper handling of internal resources within PHP.
PHP is a widely used server-side programming language that powers websites, content management systems and web applications, including WordPress, Drupal, Joomla and Laravel.
According to CERT-In, attackers could exploit the vulnerabilities by sending specially crafted requests to affected systems.
Successful exploitation could potentially allow unauthorised individuals to execute commands remotely, compromise website infrastructure, access sensitive information or disrupt online services.
The first vulnerability, CVE-2026-109618, involves improper handling of out-of-memory conditions.
Under certain circumstances, PHP may interrupt the processing of internal request data before its initialisation is complete. Subsequent cleanup operations could then incorrectly handle that data, potentially resulting in memory corruption.
The second vulnerability, CVE-2026-109619, concerns internal request information remaining accessible after the underlying memory has been released.
A later request handled by the same server worker could potentially access this stale information, creating another opportunity for exploitation.
Both weaknesses are particularly concerning because exploitation may be possible without valid login credentials.
However, the existence of these vulnerabilities does not mean that every PHP-powered website has already been compromised. Actual exposure depends on the installed PHP build, server configuration and the conditions required for exploitation.
UK Cybersecurity Agency Issues Urgent Warning
The UK’s National Cyber Security Centre has described the vulnerabilities as a serious security issue requiring immediate attention from organisations operating PHP-based systems.
In its October 21 advisory, the NCSC urged organisations to identify all PHP installations across their infrastructure, giving priority to systems accessible from the internet.
The agency warned against assuming that relatively recent PHP versions are automatically protected.
It recommended upgrading affected installations to versions containing the appropriate security fixes and continuing to monitor subsequent security advisories.
Where immediate patching is impossible, the NCSC advised organisations to examine temporary mitigation measures recommended by PHP maintainers.
The agency also suggested that operators consider temporarily taking vulnerable systems offline if neither security updates nor effective mitigations can be implemented promptly.
Administrators unable to secure their systems immediately were further advised to investigate potential signs of compromise, including unauthorised access and malicious backdoors.
The NCSC said it would continue monitoring the possible impact on UK organisations.
CERT-In Issues Additional Warning to Indian Businesses
India’s cybersecurity response has also extended to micro, small and medium enterprises.
On October 23, CERT-In issued advisory CIAD-2026-0052, specifically addressing remote code execution vulnerabilities in PHP under the name PHP2Shell.
The advisory highlighted the risk to MSMEs using PHP-based websites and applications.
For smaller businesses, the warning is particularly relevant because many depend on externally managed hosting services and may not have dedicated cybersecurity personnel.
Operators relying on shared hosting, virtual private servers or dedicated infrastructure must therefore establish whether their PHP installations have received the required security fixes.
A website running the latest version of WordPress or another content management system may still require attention if the underlying PHP installation remains vulnerable.
Emergency PHP Security Updates Released
The PHP development team released emergency security updates on October 21 to address both vulnerabilities.
The following versions contain the relevant security fixes:
| PHP Branch | Minimum Fixed Version |
|---|---|
| PHP 8.5 | PHP 8.5.12 |
| PHP 8.4 | PHP 8.4.27 |
| PHP 8.3 | PHP 8.3.36 |
| PHP 8.2 | PHP 8.2.35 |
Website administrators should install the latest applicable security release or obtain confirmation that their hosting provider has supplied an equivalent security patch.
Older and unsupported PHP versions require particular attention because they may no longer receive regular upstream security updates.
The PHP development team has warned that the vulnerabilities can affect different web-serving configurations, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
It identified Apache mod_php as presenting especially serious exposure because a demonstrated exploit could be triggered through an unauthenticated request before application code begins executing.
PHP maintainers have also emphasised that temporary mitigations are not a complete substitute for security updates.
Additional PHP Security Precaution Issued on October 23
In a further development, PHP maintainers published an informational advisory on October 23 concerning the session upload progress feature.
The developers recommended temporarily disabling the setting session.upload_progress.enabled until the next regular bug-fix release to provide additional protection against an unlikely remote code execution scenario.
This precaution relates to the vulnerability identified as CVE-2026-109619.
Administrators who had already applied the recommended mitigation were advised to retain it.
However, the additional precaution should not be treated as an alternative to installing the security updates released on October 21.
International Concern Over Website Security
The disclosure has drawn attention beyond India and the United Kingdom because PHP is widely deployed across government websites, commercial platforms, educational institutions and online publishing systems.
Cybersecurity authorities are concerned that a vulnerability affecting the underlying programming language could expose multiple applications running on the same infrastructure.
Unlike a security weakness confined to one WordPress plugin or website theme, a flaw within PHP may affect a broader range of applications using the vulnerable runtime.
This makes server-level patch management particularly important.
Reports have also circulated concerning precautionary government website shutdowns and warnings from other international security agencies.
However, the official CERT-In, NCSC and PHP advisories reviewed for this report do not independently establish the scale of any such shutdowns or confirm widespread exploitation.
Precautionary action by an organisation should not automatically be interpreted as evidence that its systems have been hacked.
Artificial Intelligence and the Growing Cybersecurity Challenge
The PHP2Shell disclosure has also prompted discussion about the growing role of artificial intelligence in cybersecurity research.
AI-assisted security tools are increasingly capable of helping researchers analyse software, identify unusual behaviour and investigate potential vulnerabilities.
The same technological developments have raised concerns about how malicious actors might use automated tools to accelerate vulnerability discovery and exploitation.
However, the official advisories reviewed do not establish that artificial intelligence was responsible for discovering these particular PHP vulnerabilities.
The confirmed issue remains the existence of two critical weaknesses requiring urgent security updates.
Warning for Website Owners in Sikkim
The cybersecurity alert carries important implications for website operators across Sikkim.
Government departments, educational institutions, tourism businesses, hotels, commercial establishments and digital news publications increasingly depend on PHP-based websites and online services.
Many of these platforms operate on WordPress or other PHP-powered applications.
Administrators should check their installed PHP versions and obtain confirmation from hosting providers that the relevant security patches have been applied.
Those managing their own servers, including virtual private servers running control panels such as Plesk, should verify the actual PHP patch level rather than relying solely on the displayed PHP branch.
For example, a server running PHP 8.3 should be checked against the fixed version, PHP 8.3.36, or an equivalent vendor-patched build.
Website owners should also maintain reliable backups, review server logs, restrict unnecessary administrative access and monitor systems for suspicious activity.
Web application firewalls and other protective measures may provide additional layers of defence, but they cannot replace the required PHP security updates.
A successful attack against a vulnerable server could potentially result in data theft, unauthorised website modifications, service disruption or further compromise of connected systems.
There is currently no verified information in the official material reviewed establishing that any website in Sikkim has been compromised through PHP2Shell.
What Should Website Administrators Do Now?
The immediate priority is to identify every PHP installation, determine whether it is affected and install the appropriate security updates.
Administrators should prioritise publicly accessible systems, particularly websites handling sensitive information, customer records, financial transactions or administrative functions.
Organisations should also ensure that backups are available and tested before carrying out major software upgrades.
Where a hosting provider manages the server, website owners should seek written confirmation that the required PHP patches have been installed.
Systems that cannot be updated immediately should be assessed for temporary mitigation measures, with potentially vulnerable services taken offline where necessary to prevent exploitation.
Critical Warning for India’s Digital Infrastructure
The simultaneous warnings from CERT-In and the UK’s NCSC underline the international significance of the PHP2Shell vulnerabilities.
As businesses, government institutions and media organisations become increasingly dependent on online services, weaknesses in widely deployed software can create risks extending far beyond individual websites.
For Indian website operators, including those in Sikkim, the message is straightforward: check PHP installations immediately, apply the available security fixes and investigate any evidence of unauthorised access.
The vulnerabilities have already been addressed in official PHP security releases. The remaining challenge is ensuring that those fixes reach every potentially exposed server before attackers can exploit the weaknesses.
