Two critical flaws in PHP — tracked as CVE-2026-109618 and CVE-2026-109619, and nicknamed PHP2Shell — let an attacker run their own code on a web server without a password or a valid account. Both are rated 9.2 out of 10. Emergency fixes were published on 21 October.
The four numbers that matter
Affected: PHP 5.4 through 8.5.11 — which is to say, almost every version anyone is running.
Fixed in: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your version number is lower than the one for your branch, you are exposed.
Scale: Prothom Alo, citing Al Jazeera, puts PHP behind around 70 per cent of websites. Professor Alan Woodward of the Surrey Centre for Cyber Security told BBC Radio 4 the flaw affects some 30 million sites.
Mitigations: none that are complete. The maintainers have said updating is the only safe choice.
What an attacker gets
Woodward put it plainly: “an attacker can get their own code on to the webserver and run it and basically do whatever they like.” That means reading your database, taking data, moving to other machines on the same network, or leaving a backdoor to return through later.
Andrew Cullen, who teaches AI and cyber security at the University of Melbourne, framed the structural problem: a great many systems depend on one basic piece of software, and the bug sits in that layer. The cloud security firm Wiz says the weaknesses appear to have been in the PHP codebase for more than a decade.
Who has to act
Anyone whose server executes PHP to answer web requests. That covers Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed — the last of which is what most cPanel shared hosting in Bangladesh runs on.
By platform, that is WordPress, Drupal, Joomla, Laravel, CodeIgniter, Magento, almost every cPanel site, most Bangladeshi news portals, e-commerce sites and government pages, and a large share of the custom PHP that small agencies here build and hand over.
The check that catches most people out
If PHP came from your operating system’s package manager, the version number may not change when the fix is applied. Distributions routinely backport security patches into the version they already ship. So reading php -v and seeing 8.2.28 does not by itself tell you whether you are patched.
The reliable test is the package changelog: look for the CVE identifiers CVE-2026-109618 and CVE-2026-109619 listed against the installed package. On shared hosting you cannot do this yourself — you have to ask the provider, in those words.
What Bangladesh should take seriously
Sumit Saha, a Bangladeshi software engineer and technology entrepreneur quoted by Prothom Alo, located the weakness in how PHP manages memory, particularly when handling severe errors such as running out of memory — a condition that can expose a server’s internal memory or allow malicious code to run.
His warning about the local picture is the one worth repeating. PHP is a modern and secure language in itself; sites become vulnerable when they run old versions or sit on badly configured servers. A great many Bangladeshi websites are built on PHP, and their code and patches are frequently not updated on time. That is what turns a global advisory into a local incident.
Related: Japan’s cyberspace state of emergency.
