Source: CERT-In advisory CIAD-2026-0052 • Date: 22 October 2026 (updated 25 October 2026)
PHP2Shell, a set of PHP remote-code-execution flaws, was flagged by CERT-In on 22 October 2026 with an urgent patch call for Indian websites, because the agency says large-scale exploitation has been reported.
PHP2Shell key facts
- CERT-In issued advisory CIAD-2026-0052 on 22 October 2026 and rates it High severity.
- It is addressed to MSMEs running PHP-based websites, content management systems, e-commerce platforms or third-party apps, especially where PHP comes bundled with hosting.
- The flaws come from memory corruption and improper resource control; an unauthenticated attacker could trigger them with a crafted request.
- A successful attack could expose or change website content, customer data and databases.
- CVE IDs listed: CVE-2026-109618 and CVE-2026-109619.
PHP2Shell: which PHP versions to patch
- PHP 8.5 before 8.5.12: upgrade to 8.5.12.
- PHP 8.4 before 8.4.27: upgrade to 8.4.27.
- PHP 8.3 before 8.3.36: upgrade to 8.3.36.
- PHP 8.2: the advisory’s affected-version line for 8.2 looks like a typo, so check the exact fixed release in the PHP security archive.
- PHP 8.1 and older are no longer supported upstream; CERT-In says to upgrade or get a vendor security-fixed package.
What site owners should do now
- Find out which PHP version your hosting runs; ask your host or software vendor if you are unsure.
- Patch internet-facing sites first and confirm the new version is actually in use.
- Check server logs, file changes, admin accounts and outbound connections for signs of compromise, and report incidents to incident@cert-in.org.in.
- Keep tested offline backups and use strong, unique admin passwords with multi-factor authentication.
PHP2Shell FAQ
What is PHP2Shell?
It is the name CERT-In uses for PHP vulnerabilities that could let a remote attacker run code on a server. CERT-In rates the advisory High severity.
Which PHP versions are affected by PHP2Shell?
PHP 8.5 before 8.5.12, 8.4 before 8.4.27 and 8.3 before 8.3.36 are listed. PHP 8.1 and older are unsupported upstream.
How do I know if my website is at risk?
Check the PHP version shown by your hosting provider; if it is below the fixed release for your branch, update it or ask your host to.
Related: Indian Government Issues Security Warning for Windows PC Users
Last updated: 25 October 2026
