PH government websites face risk from unpatched PHP servers

• TechWatch PH

DECODED: TECH, TRUTH, AND THREATS PHP is a programming language that runs on web servers to build websites and web applications, including platforms such as WordPress, Drupal, and Joomla. W3Techs, a web research service that tracks which technologies websites use, estimated that PHP powered 69.2% of websites whose server-side language it could identify as of October 28, 2026.

PHP2Shell refers to two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 and could allow an attacker to send a specially crafted request and run code on a vulnerable server without logging in. CVE, short for Common Vulnerabilities and Exposures, is a standard ID assigned to a publicly known cybersecurity vulnerability. Security agencies have already reported exploitation attempts.

The scale of potential exposure is significant. A Censys internet scan estimated that more than 34.4 million PHP services were vulnerable as of October 23. This figure counts services, not unique websites or confirmed compromises. Website owners and administrators should act urgently: updating WordPress, Joomla, or Drupal, or their plugins, does not fix PHP2Shell. They must update the PHP runtime and restart its processes. PHP says updating is the only complete fix.

The risk also affects Philippine government systems, although the number of vulnerable websites is unknown. An unconfirmed estimate puts the number of active government websites and subdomains using PHP at 4,500. DICT has not released a consolidated list of active .gov.ph domains using PHP, so the estimate could not be independently verified. DICT’s Government Web Hosting Service prescribes WordPress with the Government Web Template (GWT), other government sites may use different platforms. These facts do not mean every government website is vulnerable. A site is at risk only if it runs an affected, unpatched PHP version.

The exposure could affect websites run by national agencies, local government units, state universities, and public hospitals. Updating WordPress, Joomla, Drupal or their plugins does not fix PHP2Shell because the flaw is in the PHP runtime. DICT has already issued a warning. DICT and CERT-PH should now coordinate with agencies and their hosting providers to identify affected servers, apply PHP updates, restart PHP processes, and check for signs of compromise. PHP2Shell: Frequently Asked Questions (FAQ)

1. What is PHP? PHP is software that helps a web server build and deliver parts of a website. Think of the server as a kitchen: a visitor requests a page, PHP gathers and prepares the information, and the server sends the result to the visitor’s browser. PHP runs on the server, so this issue concerns website operators and hosting providers more directly than visitors.

2. What do the PHP usage statistics mean? W3Techs’s 69.2% figure is its estimate of the percentage of websites for which it can identify the server-side programming language. It is not a count of every website on the internet, and it does not tell us how many sites are using a vulnerable PHP version. A separate Censys scan currently estimates that about 32.5 million internet-facing PHP services report an affected version. That is a scan estimate, not a verified count of unique websites or confirmed break-ins.

3. What is PHP2Shell? PHP2Shell is the informal name for two PHP security flaws. Their official identifiers are CVE-2026-109618 and CVE-2026-109619. The flaws involve PHP mishandling information in memory while processing web requests. In simple terms, the software can become confused about what information is valid and where it is stored.

4. Why is it called PHP2Shell? “PHP to shell” describes the possible outcome of exploiting the flaws. A shell lets you give commands to a computer. The name is a nickname used for the research and the two related flaws, not their formal vulnerability names.

5. How serious is the issue? The PHP project rates both flaws 9.2 out of 10 (Critical). A score describes a vulnerability's technical severity. It does not predict that a particular website will be attacked. The concern is that, under certain conditions, an attacker may be able to remotely access the server and run code without first signing in. CISA also lists these flaws in its catalog of vulnerabilities known to have been exploited. CISA stands for the Cybersecurity and Infrastructure Security Agency. It is a US government agency that helps protect the country’s computer systems and important services from cyber threats.

6. What does “run code remotely without logging in” mean? It means someone can send a specially crafted request to an exposed server over the internet without having a website account. If the attack succeeds, the server may carry out the attacker’s instructions using the permissions available to its PHP service. This does not automatically give the attacker full control of the whole server, but it can give them a serious foothold.

7. What could an attacker do if the attack succeeds? The effects depend on how the server is set up. An attacker might try to read or change information the website can access, alter pages, disrupt the site, or use the server as a starting point for further attacks. A successful exploit does not prove that an attacker has taken over every file or account on the server, but administrators should treat a suspected attack as an incident requiring investigation.

8. Which systems are at risk? The PHP project says any PHP installation serving web requests may be affected. This includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The project considers some Apache mod_php setups especially at risk because a demonstrated attack can reach the vulnerable code before the website’s own application code runs.

9. Does this affect only WordPress? No. WordPress is one example of software that can use PHP. The flaws are in PHP itself, which is more like the engine that runs a website. Updating WordPress, a theme, or a plugin does not update that engine. Other sites and applications using a vulnerable PHP runtime may also be exposed.

10. Which PHP versions have the fix? The PHP project lists 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as fixed releases. Hosting companies, Linux distributions, and other vendors may provide the fix under a different package label. Administrators should check their vendor’s security notice and confirm that the installed package includes the PHP2Shell fixes.

11. What if a site uses an older PHP version? PHP 8.1 and older no longer receive regular updates from the PHP project. Some operating-system vendors and long-term-support providers may have added the fix to their own packages without changing the version number shown by PHP. Ask the vendor or hosting provider to confirm whether the specific package is patched. If it is not, plan to move to a supported version with the fix.

12. What should website owners and hosting providers do? First, identify every server, service, container, or product that includes PHP. Prioritize systems reachable from the internet. Install a fixed PHP release or a vendor package confirmed to include the fix, then restart the PHP processes (workers) so they load the updated software. If you can't patch a system promptly, restrict or isolate its public access while you arrange the update. A security setting may reduce some exposure, but PHP says only updating provides a complete fix.

13. What should ordinary website visitors do? The flaws are in PHP on the website’s server, not in a visitor’s phone or computer. Visitors do not need to install a PHP update or change a device setting. If you operate a website, however, contact your IT team or hosting provider and ask whether the PHP runtime has been patched.

14. Why should the government take this seriously? Government agencies operate websites and online services that people rely on, and those systems may handle personal information or support essential services. Agencies should check their own systems and the services third-party providers run for them, patch affected PHP, and investigate signs of suspicious activity. They should also give clear, practical guidance to local governments, schools, hospitals, and other organizations that may not have large IT teams. CISA’s inclusion of both flaws in its Known Exploited Vulnerabilities catalog is a strong reason for agencies to make this a prompt security priority.

15. Does a vulnerable version mean a website has been hacked? No. It means the server may be exposed; it does not prove that an attacker got in. Likewise, Censys’s estimate of affected services is not a count of successful attacks. Website operators should patch and review web server, application, and security logs for unusual activity. Warning signs can include unfamiliar files or accounts, unexpected programs running on the server, unusual commands, or connections to unfamiliar internet addresses.

A call to action

If you own or manage a website, contact your IT team or hosting provider now. Ask which PHP version your site uses, whether it has been patched for CVE-2026-109618 and CVE-2026-109619, confirm that all PHP server processes have been restarted, and review logs for suspicious activity.

PHP2Shell puts vulnerable internet-facing servers at risk. The immediate priorities are clear, identify affected systems, apply the fix, and investigate signs of compromise.