Advisory to MSME: Remote Code Execution Vulnerabilities in PHP · CIAD-2026-0052

CERT-In Advisory CIAD-2026-0052

Advisory to MSME - Remote code execution vulnerabilities in PHP (PHP2Shell)

Original Issue Date: October 22, 2026

Severity Rating: Critical

Software Affected

PHP 8.5 versions prior to 8.5.12 PHP 8.4 versions prior to 8.4.27 PHP 8.3 versions prior to 8.3.36 PHP 8.2 versions prior to 8.2.3

Overview

Multiple vulnerabilities have been reported in PHP which could allow a remote attacker to execute arbitrary code on the targeted system.

Target Audience:

All MSME organizations using PHP.

Risk Assessment:

High risk of remote code execution and complete system compromise.

Impact Assessment:

Potential for remote code execution and compromise of the affected systems.

Description

PHP is an open-source scripting language designed for server-side web development, enabling the creation of dynamic web pages.

These vulnerabilities (collectively referred to as "PHP2Shell") exist in PHP due to memory corruption and improper resource control. An unauthenticated remote attacker could exploit these vulnerabilities by sending a specially crafted request to the targeted system.

Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary code on an affected server, potentially exposing or modifying website content, customer data, databases, and other linked resources.

Micro, Small and Medium Enterprises (MSME) operating PHP-based websites, content-management systems, e-commerce platforms, or third-party applications could face security risks, particularly where PHP comes bundled with their hosting services or other software.

Note: Multiple reports confirm large scale exploitation in the wild, users are advised to patch urgently.

Recommendations:

MSMEs are advised to undertake the following actions:

Identify PHP usage: Check whether the website, hosting account, content-management system, or business application uses PHP. If the PHP version is unknown, contact the hosting provider or software vendor for confirmation.

Apply security updates: Upgrade affected PHP installations to the appropriate fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or vendor's fixed package.

Prioritise internet-facing systems: Remediate public-facing websites and applications first. After applying updates, restart the relevant services as needed and verify that the updated PHP runtime is actually in use.

Address unsupported versions: PHP 8.1 and earlier versions are no longer supported by the upstream PHP project. Upgrade to a supported release, or obtain and verify a security-fixed package from the relevant vendor.

Restrict exposure where patching is delayed: If an affected system cannot be patched immediately, consider restricting access to trusted networks until remediation is completed. Also follow mitigation steps mentioned by the vendor.

Check for signs of compromise: Check for signs of compromise by reviewing available web-server and application logs for unusual requests, unexpected file changes, newly created administrator accounts, suspicious processes, and unexplained outbound connections. If compromise or suspicious activity is detected, preserve relevant logs, contain the incident, and promptly report it with available evidence to CERT-In at incident@cert-in.org.in

Secure business information: Protect business information by maintaining regular offline or otherwise secure backups, testing that restoration works, and ensuring administrative accounts use strong, unique passwords and multi-factor authentication wherever supported.

Vendor Information

PHP https://www.php.net/archive/2026.php#2026-10-21-5

References

PHP https://www.php.net/archive/2026.php#2026-10-21-5

CVE Name

CVE-2026-109618 CVE-2026-109619