PH government urged to issue nationwide alert over critical ‘PHP2Shell’ flaws

• Tech Watch PH

Cybersecurity authorities in the Philippines are facing urgent calls to issue a nationwide warning over a pair of critical security flaws in the PHP programming language that foreign governments warn are under active exploitation.

The appeal was lodged in an open disclosure letter addressed to the Department of Information and Communications Technology (DICT), the National Computer Emergency Response Team (CERT-PH), the Cybercrime Investigation and Coordinating Center (CICC), law enforcement cyber units, and the National Privacy Commission (NPC). The vulnerabilities, collectively dubbed "PHP2Shell" and tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10 under CVSS v4.0. They allow unauthenticated attackers to execute arbitrary code remotely on target servers through specially crafted web requests.

The PHP development team issued emergency updates on October 21, accelerating deployment after technical details leaked publicly a day earlier. International agencies—including the European Union’s CERT-EU, the UK National Cyber Security Centre (NCSC), the Cyber Security Agency of Singapore (CSA), and the Australian Cyber Security Centre (ACSC)—have since released high-priority advisories instructing organizations to patch immediately or disconnect exposed systems.

The disclosure letter, submitted by Philippine security researcher Mark Lester Dampios, highlighted the absence of a formal advisory from local regulators as a critical gap for domestic infrastructure.

"The absence of a Philippine advisory on a flaw of this severity leaves thousands of government and private-sector systems exposed with no official direction on what to do," the submission stated. Severe Local Exposure According to technical briefs on the flaw, PHP2Shell affects server installations running unpatched versions between PHP 5.4 and PHP 8.5. The vulnerability resides within the core PHP engine rather than individual third-party plugins or web applications. Researchers have confirmed functional exploits against standard deployments of major content management systems, including WordPress, Drupal, and Magento.

The alert emphasized that Philippine public agencies are disproportionately vulnerable due to the widespread adoption of PHP across the government. Most local government units (LGUs), state universities and colleges (SUCs), and national departments operate web portals based on the official Government Website Template (GWT), which relies heavily on PHP frameworks.

Furthermore, many public and private systems continue to operate on legacy, end-of-life (EOL) versions of PHP, such as branches 5.x through 8.1, which no longer receive automated security patches from upstream developers.

Internet security provider Cloudflare and threat analysts have observed active scanning and preliminary exploitation attempts against vulnerable servers globally. Recommended Remediation Steps Security agencies and independent researchers recommend the following immediate actions for system administrators:

Upgrade Runtimes: Update production environments directly to supported, patched releases: PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, followed by a full service restart of web daemons (such as PHP-FPM or Apache).

Handle Legacy Deployments: Migrate EOL servers immediately or compile vendor backport patches made available for versions 7.4 through 8.1.

Temporary Mitigations: If patching cannot be executed immediately, administrators are advised to disable file upload tracking by setting session.upload_progress.enabled = 0 in root server configurations and filter multipart/form-data requests at the web application firewall (WAF) or reverse-proxy layer.

Compromise Audits: Review server logs for anomalous multipart requests, unexpected HTTP 500 error spikes, and memory-limit termination errors, while scanning web directories for unauthorized file modifications or newly planted web shells.

Philippine agencies and critical information infrastructure operators have been urged to inventory all internet-facing PHP deployments while formal directives from CERT-PH and the DICT remain pending.

The warning also comes ahead of November 5, the date associated with the annual Million Mask March (MMM), a protest movement linked to Anonymous. Its history includes cyberattacks against Philippine government websites, adding urgency to efforts to secure exposed public systems.

Preparations should include verified patch deployment, checks for existing compromise, tested recovery procedures, and coordination among government security teams. Any temporary isolation of vulnerable systems should have clear technical grounds and a restoration plan. For the DICT and CERT-PH, the approaching November 5 date reinforces the need for timely, actionable guidance. Readiness must be measured by the government's ability to protect information, sustain essential services, and restore operations quickly when incidents occur.