What the critical PHP flaw means for your business

Insights

If your website or business applications use PHP, this deserves immediate attention.

Two critical vulnerabilities known as PHP2Shell have been disclosed with a reported severity rating of 9.2/10. Successful exploitation could potentially result in complete compromise of a vulnerable server.

The priority is straightforward: identify, patch, investigate and monitor. Consider also whether suppliers and other third parties running PHP could create exposure for your business.

Redesmere can help organisations understand their exposure, investigate potential compromise and put stronger defences in place.


What’s happened? 

On the 21st October, the team behind PHP released emergency updates for two vulnerabilities, informally known as PHP2Shell.  It is estimated that around 70% of websites worldwide are running on top of some version of PHP. 

On a scale of 1 to 10, how bad is it? 

The official CVSS score for these vulnerabilities is 9.2 out of 10 for severity.  What this really means is:

  1. An attacker can exploit it over the internet. 
  2. They don’t need to have an existing login. 
  3. No user interaction is required for a full system compromise to take place. 

If an attack is successful, the server can be fully taken over both from a data and service perspective. The slightly positive news (at this moment) is that the complexity of the attack is high.  It requires the right combination of PHP build, extensions, memory layout and front-end setup to be successful.  The vulnerability comes down to two separate flaws, full details of which are available at CVE-2026-109618 and CVE-2026-109619. 

How do I know if I’ve been affected already? 

It seems that the flaws were discovered well before the 20th October, so check logs from mid-October onwards. The attack runs below the application layer, so don’t assume that all is ok if the application logs are clear.  Take a copy of any logs as they exist right now to ensure that they are not overwritten by a 7 day log rotation. 

Then check the following: 

  • Web server error logs: PHP memory errors and worker crashes. 
  • PHP / PHP-FPM logs: repeated fatal errors and workers crashing/restarting. 
  • Web server access logs: unusual uploads to PHP pages/spikes in 500 errors. 
  • System and kernel logs: low-level crashes and out-of-memory events. 
  • WAF / CDN logs: blocked or flagged exploit attempts. 
  • EDR logs: the web server running shells or making unexpected outbound connections. 
  • PHP session folder: malformed/oversized session files. 
  • Web root and upload folders: new or unexpectedly modified PHP files. 

If there are any signs of compromise, isolate the affected services and rebuild where necessary.  Patch systems, change passwords and any other secrets.  Then monitor ingress/egress points.  

Our team is available to help wherever needed. 

How can we protect our business? 

If you’re still running an unsupported version of PHP, urgent action needs to be taken.  A WAF (Web Application Firewall) may be a robust addition to your defences if you don’t already have one in place, but is only a stopgap until systems are patched. 

Patch any PHP servers with the new releases from the official sources. It won’t be long before the automated attacks grow exponentially against the vulnerable instances. 

There’s more to think about, even if your own services appear to be unaffected.  This is a key time to consider the potential risks in your supply chain, and act accordingly.  Think about how a compromised supplier could impact your business through any processes or interactions. 

How can Redesmere help?

If you’re uncertain where PHP is running across your estate, or whether your supplies have done what they’ve said, Redesmere are here to help.  We can carry our a rapid exposure check and identify any potentially affected systems.  

Our other services include: 

  • Compromise Assessment: We will review logs for warning signs and guide you through updating systems are changing credentials wherever needed. 
  • Long-term resilience: Security hygiene assessments and support with cybersecurity processes, so the next major flaw doesn’t result in a panic. 

PHP2Shell is serious but fixable.  If you have any concerns, speak to the Redesmere team today and we will help you understand what to do next.



What the critical PHP flaw means for your business

Insights

If your website or business applications use PHP, this deserves immediate attention.

Two critical vulnerabilities known as PHP2Shell have been disclosed with a reported severity rating of 9.2/10. Successful exploitation could potentially result in complete compromise of a vulnerable server.

The priority is straightforward: identify, patch, investigate and monitor. Consider also whether suppliers and other third parties running PHP could create exposure for your business.

Redesmere can help organisations understand their exposure, investigate potential compromise and put stronger defences in place.


What’s happened? 

On the 21st October, the team behind PHP released emergency updates for two vulnerabilities, informally known as PHP2Shell.  It is estimated that around 70% of websites worldwide are running on top of some version of PHP. 

On a scale of 1 to 10, how bad is it? 

The official CVSS score for these vulnerabilities is 9.2 out of 10 for severity.  What this really means is:

  1. An attacker can exploit it over the internet. 
  2. They don’t need to have an existing login. 
  3. No user interaction is required for a full system compromise to take place. 

If an attack is successful, the server can be fully taken over both from a data and service perspective. The slightly positive news (at this moment) is that the complexity of the attack is high.  It requires the right combination of PHP build, extensions, memory layout and front-end setup to be successful.  The vulnerability comes down to two separate flaws, full details of which are available at CVE-2026-109618 and CVE-2026-109619. 

How do I know if I’ve been affected already? 

It seems that the flaws were discovered well before the 20th October, so check logs from mid-October onwards. The attack runs below the application layer, so don’t assume that all is ok if the application logs are clear.  Take a copy of any logs as they exist right now to ensure that they are not overwritten by a 7 day log rotation. 

Then check the following: 

  • Web server error logs: PHP memory errors and worker crashes. 
  • PHP / PHP-FPM logs: repeated fatal errors and workers crashing/restarting. 
  • Web server access logs: unusual uploads to PHP pages/spikes in 500 errors. 
  • System and kernel logs: low-level crashes and out-of-memory events. 
  • WAF / CDN logs: blocked or flagged exploit attempts. 
  • EDR logs: the web server running shells or making unexpected outbound connections. 
  • PHP session folder: malformed/oversized session files. 
  • Web root and upload folders: new or unexpectedly modified PHP files. 

If there are any signs of compromise, isolate the affected services and rebuild where necessary.  Patch systems, change passwords and any other secrets.  Then monitor ingress/egress points.  

Our team is available to help wherever needed. 

How can we protect our business? 

If you’re still running an unsupported version of PHP, urgent action needs to be taken.  A WAF (Web Application Firewall) may be a robust addition to your defences if you don’t already have one in place, but is only a stopgap until systems are patched. 

Patch any PHP servers with the new releases from the official sources. It won’t be long before the automated attacks grow exponentially against the vulnerable instances. 

There’s more to think about, even if your own services appear to be unaffected.  This is a key time to consider the potential risks in your supply chain, and act accordingly.  Think about how a compromised supplier could impact your business through any processes or interactions. 

How can Redesmere help?

If you’re uncertain where PHP is running across your estate, or whether your supplies have done what they’ve said, Redesmere are here to help.  We can carry our a rapid exposure check and identify any potentially affected systems.  

Our other services include: 

  • Compromise Assessment: We will review logs for warning signs and guide you through updating systems are changing credentials wherever needed. 
  • Long-term resilience: Security hygiene assessments and support with cybersecurity processes, so the next major flaw doesn’t result in a panic. 

PHP2Shell is serious but fixable.  If you have any concerns, speak to the Redesmere team today and we will help you understand what to do next.


© Redesmere Limited . All rights reserved

Redesmere Limited, Barrington House, Heyes Lane, Alderley Edge SK9 7LA