Two highly critical security vulnerabilities, collectively known as 'PHP2Shell', have been identified in PHP, one of the world's most popular programming languages. These flaws allow hackers to gain complete remote control over website servers without requiring any username or password. Following initial reports, the Bangladesh e-Government Computer Incident Response Team (BGD e-GOV CIRT) issued a high-alert advisory on Thursday, October 22, to safeguard national digital infrastructure. Relevant sources stated that immediate countermeasures are vital to mitigate potential exploits.

Critical 'PHP2Shell' Flaw Threatens Web Infrastructure; Bangladesh Ramps Up Alerts

According to BGD e-GOV CIRT, the tracking IDs for these vulnerabilities are CVE-2026-109618 and CVE-2026-109619, carrying a severity CVSS score of 9.2, categorized as critical. The advisory notes that the underlying issue stems from PHP's memory management mechanism. When server memory exhausts or fails to purge residual data from prior requests, attackers can send crafted HTTP requests to execute arbitrary malicious code on the server execution layer.

Consequently, environments utilizing PHP-FPM and Apache's 'mod_php' face severe risk. Furthermore, applications relying on PHP-CGI, FrankenPHP, LiteSpeed, Docker containers, and shared hosting setups across national portals, banking platforms, e-commerce, WordPress, and Laravel frameworks are exposed. Successful exploitation could lead to full server compromise, data theft, leakage of database credentials and API keys, and total system outages.

PHP Security Flaws Force Websites Offline

To neutralize the threat, CIRT instructed administrators to immediately update their PHP runtime to patched versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The agency stressed that updating the core PHP runtime environment is critical, beyond framework-level patches. For systems unable to deploy immediate patches, temporary mitigation measures include placing servers behind VPNs, IP whitelisting, and intensifying log monitoring; however, updating the runtime remains the only permanent resolution.

//DBTech/JNU/SMP/FODI//