CRITICAL PHP SECURITY ALERT: Server Patching Website Owners Must Remove Malware, Secure Accounts and Update Applications Immediately

Priority: CRITICAL
Recommended response window: Immediate assessment, with a 24–72-hour target for applicable critical exposures.

Overview

Website owners, hosting customers, resellers, developers and system administrators are urged to take immediate action following the disclosure of critical PHP security vulnerabilities that could permit unauthenticated remote code execution on vulnerable web servers.

On 21 October 2026, the PHP development team released security updates addressing CVE-2026-109618 and CVE-2026-109619, commonly referred to as the PHP2Shell vulnerabilities. European cybersecurity authorities and the UK National Cyber Security Centre have also issued urgent remediation guidance.

The vulnerabilities affect PHP request processing and may allow attackers to execute malicious code remotely under applicable conditions.

The official PHP security release information is available here:

Customers should consult these authoritative sources and their operating-system or hosting vendor's advisories to confirm the appropriate security updates for their environments.

Server-level patching has been applied — customer action remains mandatory

Kak Infotech has reported that server-level security patching has been applied to its hosting infrastructure. However, customers, resellers and developers must still check their individual websites, applications, files, credentials and hosting accounts.

Server hardening and vulnerability patching do not automatically remove malware or clean websites that may have been compromised before remediation.

An attacker who gained access before the patch was installed may have left behind malicious PHP scripts, web shells, backdoors, injected JavaScript, unauthorized administrator accounts or stolen credentials. Such mechanisms may remain active after the underlying server vulnerability has been fixed.

Consequently, some websites may continue to experience malware alerts, suspicious redirects, unauthorized content changes, spam, errors or other security issues even when the hosting provider confirms that its server-level patching is complete.

Every potentially affected account must be assessed individually. A successful server update is an important security measure, but it is not proof that every website is clean.

Vulnerabilities covered by this notice

CVE-2026-109618 — PHP out-of-memory handling and memory corruption

Improper handling of memory-allocation failures during request processing may corrupt internal state and potentially allow unauthenticated remote code execution.

CVE-2026-109619 — PHP use-after-free and stale request state

Request-related internal state may be used after the associated memory has been freed. Under applicable conditions, this may permit unauthenticated remote code execution.

Both vulnerabilities have been reported with a CVSS v4.0 score of 9.2.

The PHP security releases addressing these issues include:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

Administrators should confirm the correct fixed release for their installation and operating-system vendor. Older PHP branches may be unsupported by the PHP project, although some vendors may provide backported security fixes.

Additional issue: CVE-2026-115560

A separate PHP session upload-progress issue has also been reported. Its applicability depends on specific configuration and application conditions and should be assessed independently.

Installing the PHP2Shell fixes should not be assumed to resolve this separate issue. Consult the latest PHP and vendor advisories for the applicable mitigation and patch status.

References:

Potential consequences of exploitation

Successful exploitation may result in:

  • Unauthorized code execution on affected web servers.
  • Malicious files, scripts and backdoors being inserted into websites.
  • Theft of customer data, database credentials, API keys or application secrets accessible to the compromised process.
  • Unauthorized CMS administrator accounts or changes to website permissions.
  • Website defacement, phishing pages, malicious redirects and search-engine spam.
  • Unauthorized email sending, resource abuse and service disruption.
  • Attempts to access other websites, databases or systems where permissions and network access allow.

These are potential impacts and should not be interpreted as confirmation that every PHP-powered website has been compromised.

Mandatory action 1: Inspect websites and remove confirmed malware

All customers and resellers should arrange a security inspection of potentially affected websites, especially internet-facing sites that were exposed before the security update.

Website developers and security administrators should:

  1. Scan website files and directories for malware, suspicious scripts and unauthorized modifications.
  2. Investigate newly created or modified PHP files, particularly in upload directories and unexpected locations.
  3. Check for web shells, backdoors, obfuscated scripts, malicious redirects and persistence mechanisms.
  4. Compare CMS core files and application files with clean, trusted versions.
  5. Review .htaccess, web-server configuration, scheduled tasks and other locations where malicious changes may persist.
  6. Inspect administrator accounts, FTP/SFTP users, database users and other access mechanisms for unauthorized additions.
  7. Remove confirmed malicious code or restore from a verified clean backup.
  8. Run follow-up scans and confirm that the infection does not return.

Do not indiscriminately delete unfamiliar files. Investigate suspicious findings carefully and preserve evidence if a compromise is suspected.

For assistance with incident assessment, review the NCSC guidance:

https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Mandatory action 2: Update CMS platforms, plugins, themes and dependencies

Server-level PHP updates do not automatically update website applications or third-party components.

Customers and developers must review and update all applicable software, including:

  • WordPress core, plugins and themes.
  • Joomla core, extensions and templates.
  • Drupal core, modules and themes.
  • Laravel, Symfony and other PHP frameworks.
  • Composer packages and third-party libraries.
  • Custom PHP applications, payment integrations and API connectors.
  • E-commerce platforms and other applications that bundle PHP.
  • Control-panel integrations and third-party software dependencies.

Install security updates from official software vendors, remove abandoned components and verify application compatibility.

Review all earlier security warnings and outstanding software updates. Previous warnings must not be ignored simply because the latest server-level patch has been applied. Earlier vulnerabilities and existing malware may require separate remediation.

For identifying products that bundle or depend on PHP, consult:

https://github.com/NCSC-NL/php2shell

For general PHP security updates, consult:

https://www.php.net/security

Mandatory action 3: Secure customer, reseller and developer accounts

Patching the server does not automatically secure credentials that may have been exposed before remediation.

Customers and administrators should:

  • Change potentially exposed hosting, CMS, FTP/SFTP and SSH passwords.
  • Rotate database credentials, API keys and application secrets that may have been accessible to an attacker.
  • Enable multifactor authentication wherever supported.
  • Remove unauthorized administrator accounts, SSH keys, access tokens and other credentials.
  • Review login histories and investigate suspicious access.
  • Restrict administrative interfaces to trusted networks where practical.
  • Secure domain registrar and DNS accounts with MFA.
  • Investigate unauthorized DNS changes.
  • Avoid reusing passwords across websites and hosting accounts.

Coordinate credential changes with dependent applications and services to prevent unnecessary outages. Where compromise is suspected, perform rotations from a trusted device and follow an appropriate incident-response process.

Mandatory action 4: Apply account-level and application-level hardening

In addition to PHP patching, review website and account security.

Recommended measures include:

  • Correct file and directory permissions.
  • Prevent PHP execution in upload directories wherever the application permits.
  • Disable unnecessary services and PHP features where appropriate.
  • Apply suitable request-size, upload and execution limits.
  • Separate customer accounts and websites to limit cross-account access.
  • Restrict database and application permissions to the minimum necessary.
  • Review PHP-FPM pools, Apache configurations, CGI/FastCGI, LiteSpeed and container isolation where applicable.
  • Maintain protected backups and test recovery procedures.
  • Enable security monitoring and file-integrity alerts.

Hosting providers should verify that all relevant PHP execution paths and internet-facing services have been assessed.

Temporary mitigations must follow the applicable vendor guidance and must not be treated as a substitute for security updates.

Mandatory action 5: Investigate websites that continue to experience problems

Websites may continue to show security or operational issues after the server has been patched.

Investigate the following warning signs:

  • Redirects to unfamiliar websites.
  • Unexpected pop-ups, spam pages or injected JavaScript.
  • Search-engine security warnings or blacklisting.
  • Unknown administrator accounts or unauthorized content changes.
  • Suspicious files or repeated malware detections.
  • Abnormal CPU usage, bandwidth or outbound email activity.
  • Unexpected DNS or SSL certificate changes.
  • PHP errors, HTTP 500 responses or broken functionality after updates.

These symptoms do not all prove exploitation of the PHP vulnerabilities. They may also arise from other vulnerabilities, malware infections, application incompatibilities or configuration errors.

If active compromise is suspected, preserve logs and evidence, restrict or isolate the affected application where necessary, and follow an incident-response plan. Restore only from backups verified as clean.

Where sensitive information may have been exposed, assess the impact and comply with applicable notification requirements.

Mandatory action 6: Verify patching and document completion

Each customer, reseller and developer should verify that:

  • The active PHP runtime is running a vendor-fixed version.
  • Applicable server and application updates have been installed.
  • Website files have been inspected and confirmed malware has been removed where detected.
  • Customer and administrator accounts have been reviewed.
  • Potentially exposed credentials have been rotated.
  • Security logs have been reviewed.
  • Critical website functionality has been tested.
  • Follow-up scans do not identify unresolved threats.
  • Backups and recovery procedures have been checked.

Document the affected sites, remediation steps, verification results, remaining risks and completion date.

If a website cannot be confirmed clean, keep its status as unresolved and continue the investigation. Do not treat server patching alone as proof of successful cleanup.

Responsibilities of hosting providers

Hosting providers should:

  • Inventory affected PHP installations and services.
  • Apply security updates across relevant hosting environments.
  • Restart affected services where necessary to load the updated runtime.
  • Verify the running version and patch status.
  • Review infrastructure logs and monitor suspicious activity.
  • Check account isolation and shared-hosting boundaries.
  • Investigate confirmed hosting-level compromises.
  • Provide customers with clear remediation instructions and escalation channels.

Server-level hardening and customer-level cleanup are complementary responsibilities. Neither replaces the other.

Recommended deadline: Immediate assessment, with a 24–72-hour target

Kak Infotech recommends that customers, resellers and developers begin their assessments immediately and target remediation within 24–72 hours for applicable critical internet-facing exposures.

This is a recommended response window, not a universal deadline imposed by the PHP development team.

If a customer cannot patch immediately, the hosting provider or security team should be consulted about appropriate temporary mitigation, access restriction or isolation of the affected service.

Where Kak Infotech has separately issued a mandatory compliance deadline under its service terms or security policies, customers should follow the applicable notice. Any service restriction should be based on the relevant policy and assessed security risk.

Official references and security resources

The following resources provide further information on the PHP vulnerabilities, remediation requirements, third-party software exposure and PHP usage statistics.

A. Official PHP resources

  1. PHP 2026 release archive and security updates
    https://www.php.net/archive/2026.php
  2. PHP security announcements
    https://www.php.net/security
  3. PHP source-code vulnerability advisories
    https://github.com/php/php-src/security/advisories
  4. PHP downloads and supported releases
    https://www.php.net/downloads.php

B. Government and European cybersecurity authorities

  1. UK National Cyber Security Centre — Critical security issue affecting PHP
    https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
  2. European Union Agency for Cybersecurity — Joint statement on critical PHP vulnerabilities
    https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities
  3. CERT-EU — Security Advisory 2026-018: Critical Vulnerabilities in PHP
    https://www.cert.europa.eu/publications/security-advisories/2026-018
  4. NCSC-NL — Third-party software potentially affected by PHP2Shell
    https://github.com/NCSC-NL/php2shell
  5. ENISA advisory collection — PHP security advisory
    https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md

C. Additional technical and threat-analysis resources

  1. Google Cloud — Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
    https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
  2. Palo Alto Networks Unit 42 — PHP2Shell vulnerability analysis
    https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
  3. Rapid7 — Critical unauthenticated remote code execution in PHP
    https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/
  4. Oracle — Security Alert CVE-2026-109618 and CVE-2026-109619
    https://www.oracle.com/security-alerts/alert-cve-2026-109618.html
  5. Snyk — PHP security fixes and information on CVE-2026-115560
    https://snyk.io/blog/php-patches-critical-unauthenticated-rces/

D. PHP usage statistics

  1. W3Techs — PHP usage statistics
    https://w3techs.com/technologies/details/pl-php

Website technology statistics represent reported technology usage and should not be interpreted as a count of confirmed vulnerable or compromised websites.

Final security notice

Kak Infotech urges all customers, resellers, developers and website administrators to take immediate action to safeguard their websites and hosting accounts.

The key message is simple: the server may be patched, but every potentially exposed website must still be assessed, cleaned where necessary, updated and verified.

Install the applicable PHP security updates, update CMS platforms and dependencies, remove confirmed malicious code, secure customer and reseller accounts, rotate potentially exposed credentials, investigate unresolved website issues and complete verification.

Review all previous security warnings and outstanding updates as part of the same remediation process. A website that remains infected or improperly secured can continue to pose a security risk even after the underlying server has been patched.

Contact your website developer, system administrator or hosting support team and request confirmation of the patch status, website inspection, cleanup actions and final verification results.

Recommended action: Begin immediately; target remediation within 24–72 hours for applicable critical exposures.

 



Saturday, October 24, 2026





« Back