The National Cyber Security Agency (NACSA), through its National Cyber Coordination and Control Centre (NC4), is urging organisations running internet-facing PHP applications to immediately install security updates and conduct vulnerability assessments following the discovery of two critical vulnerabilities.
Known collectively as PHP2Shell, the flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP security team released emergency updates on 21 October 2026 to address both vulnerabilities, which could allow attackers to execute malicious code on affected web servers without requiring authentication.
In case you missed it, the discovery of the PHP vulnerabilities has prompted precautionary shutdowns of government websites and online services around the world while security patches were being rolled out. As reported earlier, several major services, including Wikipedia, temporarily took their systems offline to address the risk.
