The National Cyber Security Agency (NACSA), through its National Cyber Coordination and Control Centre (NC4), is urging organisations running internet-facing PHP applications to immediately install security updates and conduct vulnerability assessments following the discovery of two critical vulnerabilities.
Known collectively as PHP2Shell, the flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP security team released emergency updates on 21 October 2026 to address both vulnerabilities, which could allow attackers to execute malicious code on affected web servers without requiring authentication.
In case you missed it, the discovery of the PHP vulnerabilities has prompted precautionary shutdowns of government websites and online services around the world while security patches were being rolled out. As reported earlier, several major services, including Wikipedia, temporarily took their systems offline to address the risk.
Organisations Urged To Install Security Updates
NC4 is advising administrators to upgrade to patched PHP versions, namely PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or newer patched releases in their respective branches. Those running PHP 8.1 or older versions should upgrade to a supported release or obtain verified security patches from their vendors, as these older versions no longer receive security updates from the PHP project.
Organisations that cannot apply the fixes immediately should refer to NC4’s official advisory for temporary mitigation measures. Separately, the Malaysia Computer Emergency Response Team (MyCERT) recommends temporarily taking internet-facing PHP systems offline if the patches cannot be applied immediately.
NC4 also advises organisations to monitor server logs for suspicious activity and isolate affected systems if a compromise is suspected. Those relying on shared hosting or third-party managed services should contact their providers to confirm that the necessary updates have been installed.
