Two critical flaws in PHP, the programming language behind a large share of the world’s websites, were made public and fixed on 21 October 2026. Here is what they mean for your business and what to do this week.
The flaws, known as PHP2Shell, let an attacker with no username or password run their own commands on an unpatched web server. In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) has told organisations to patch immediately or take affected systems offline, and in the UK the National Cyber Security Centre (NCSC) is urging organisations to act now. Continent 8 Technologies is advising every customer to treat this as a priority for the coming days.
“PHP2Shell sits in the engine underneath thousands of everyday business websites, so the question for every board this week is simple: do you know everywhere PHP runs, including at your suppliers and partners, and has each of those systems been updated? Our security teams are already working with customers to answer that question”, said Anthony Abou-Jaoude, Chief Transformation Officer, Continent 8 Technologies.
What has happened
The two flaws carry the industry reference numbers CVE-2026-109618 and CVE-2026-109619. Researchers at Calif, Wiz and OpenAI found them with the help of AI tools and reported them privately to the PHP project in August. Details leaked online on 20 October, so the PHP security team released its fixes a day earlier than planned and rated both flaws 9.2 out of 10.
The weakness sits in PHP itself rather than in any single website or product. Popular systems built on PHP, including WordPress, Magento and Drupal, are exposed unless the server underneath has been updated. On the day of release, internet scanning company Censys counted more than 2.5 million servers on the internet running PHP, although not all of them will be vulnerable.
Tools to exploit the flaws are now public, and watchTowr reports attack attempts against its monitoring systems. CISA said in its alert that it had not yet seen exploitation, and as of the evening of 21 October no successful attacks had been publicly confirmed. History suggests the gap will be short: when a previous critical PHP flaw was disclosed in 2024, attackers were trying to exploit it within a day, according to Greenbone.
Why it matters to your business
A web server taken over through PHP2Shell gives an attacker a foothold close to player accounts, payment journeys and back-office systems. Security firm Sansec also reports that one of the flaws can leak fragments of server memory, which may include passwords and access keys, even where no takeover happens.
For licensed operators and their suppliers, a breach quickly becomes a regulatory matter wherever they hold licences. In Great Britain, the Gambling Commission expects a security breach that affects the confidentiality of customer data, or stops customers reaching their accounts for more than 12 hours, to be reported as a key event within five working days. The Malta Gaming Authority asks for similar incidents to be reported through its Licensee Portal within 72 hours, and data protection law sets its own 72-hour deadline for personal data breaches. Businesses that handle card payments should note that PCI DSS expects critical security patches to be installed within one month of release.
In the United States, each state gaming regulator, such as New Jersey’s Division of Gaming Enforcement or the Pennsylvania Gaming Control Board, sets its own security requirements for online operators and their suppliers, so check your licence conditions for when an incident must be reported. Every state also has its own data breach notification law with its own deadlines. Companies listed on a US exchange face a further clock: under SEC rules, a cybersecurity incident judged to be material must be disclosed on Form 8-K within four business days of that judgement.
Availability is at stake as well. The NCSC, CISA and the European Union’s computer emergency response team, CERT-EU, all advise taking systems offline or isolating them if they cannot be fixed promptly. A planned maintenance window now costs far less than an unplanned outage or an incident investigation later.
What to do this week
Start by finding out where PHP is running. It is rarely confined to one platform. In our sector it often sits behind affiliate and comparison sites, marketing microsites built on content management systems such as WordPress, internal admin tools, older cashier pages and products bought from third parties. CISA warns that PHP is often built into other software, where it may not be obvious, and the NCSC advises checking every PHP installation, starting with anything reachable from the internet, and not assuming that only out-of-date versions are affected.
Next, update and restart. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the major Linux distributions are publishing their own patched packages. Web servers must be restarted after the update, or the old code keeps running. Systems on PHP 8.1 or older no longer receive official fixes and need an upgrade or a vendor patch. Where an update cannot happen straight away, the PHP project has published temporary settings that reduce some of the risk, and a web application firewall (WAF), which filters malicious traffic before it reaches the server, can buy time. Neither replaces the update.
Then check whether anything has already happened. The NCSC recommends looking for backdoors as well as patching. In practice that means searching for web shells, which are small malicious files an attacker leaves behind to keep access, along with unexpected programs started by the web server and unexplained crashes in PHP logs. The attack can succeed without crashing anything, so a quiet system is no proof of a clean one. If a system may have been compromised, change every password and key it held.
Finally, be ready to report and bring your suppliers in. Confirm who decides whether an incident is notifiable, and make sure your compliance team has the reporting deadlines for every regulator you answer to, including gaming, data protection and, for listed companies, securities regulators. Ask every supplier and partner that runs PHP on your behalf to confirm in writing that they have patched and checked for compromise, and keep a record of their answers.
How Continent 8 can help
Our secure8 services can support each of those steps.
Talk to us
If you are unsure whether PHP2Shell affects you or your suppliers, contact your Continent 8 account manager or our security team today. If you suspect an active compromise, please get in touch so our analysts can respond as quickly as possible. We will update this advisory as the situation develops.