PHP’s release guidance was checked against Canadian and Singaporean cyber-agency alerts and Unit 42’s own exposure telemetry. INCE NEWS has not independently measured attack activity or confirmed how many exposed installations have been compromised.
Attack attempts follow the release of patches
Singapore’s Cyber Security Agency warned on October 23 that widespread attempts to exploit two critical PHP vulnerabilities were continuing, urging operators to install security updates immediately. The flaws can let an attacker run code on a vulnerable server without logging in.
The warning followed PHP’s October 21 release of fixes for CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both carry a severity score of 9.2 out of 10 under CVSS version 4.0.
PHP powers web applications and can also sit inside third-party software. Singapore’s agency advises organisations to look for it across their servers and components even when their main website does not use the language.
Exposure is not a count of successful intrusions
Palo Alto Networks’ Unit 42 said its telemetry identified more than 22.6 million exposed instances that were potentially vulnerable. That is an exposure estimate, not a tally of compromised websites.
The PHP team says installations handling web requests are at risk across several configurations, including PHP-FPM and Apache’s mod_php. It assesses the risk as highest for mod_php: a demonstrated exploit can act before the website’s own application code runs.
Four supported branches have fixed releases
The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Operators using distribution packages or long-term-support vendors should check those suppliers’ patched packages. PHP 8.1 and older are outside the project’s routine update support; vendor backports or migration to a supported branch may be needed.
PHP’s temporary configuration measures reduce exposure to particular attack paths but are not a complete remedy. Canada’s Cyber Centre recommends prioritising internet-facing systems and considering isolation from public networks when immediate patching is not feasible.
The Canadian guidance also calls for checking products and containers that bundle PHP, reviewing logs for suspicious activity, and investigating unexpected processes, files, accounts or outbound connections associated with web-server services.
Sources
4 references
- PHP GroupSecurity advisory: Critical remote code execution vulnerabilities, update nowPrimary evidence — maintainer advisory and release guidance · 21 October 2026
- Cyber Security Agency of SingaporeCritical Vulnerabilities in PHP (PHP2Shell)Primary evidence — government threat advisory · Updated 23 October 2026
- Canadian Centre for Cyber SecurityAL26-026 — Critical vulnerabilities impacting PHPPrimary evidence — government mitigation guidance · 21 October 2026
- Palo Alto Networks Unit 42Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619Independent technical analysis and first-party exposure telemetry · Updated 22 October 2026
