Philippine government agencies and businesses using PHP for their websites need to check whether the software has received security updates to address two critical flaws, according to the Department of Information and Communications Technology (DICT), through its National Computer Emergency Response Team of the Philippines (CERT-PH).
In an advisory, CERT-PH warned of two security flaws, together called PHP2Shell, in PHP, the software that helps many websites run. Websites managed by outside hosting companies may also be affected. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619.
“Updating a CMS or website application without updating the underlying PHP installation does not remediate the vulnerability,” CERT-PH said.
Known together as PHP2Shell, the flaws affect the underlying software that runs many websites. This means agencies and businesses need to check their servers or contact their hosting providers, even if their website applications are already updated.
“Updating a CMS or website application without updating the underlying PHP installation does not remediate the vulnerability,” CERT-PH said.
PHP is used to run content management systems (CMS), which allows organizations to publish and manage website content, as well as business applications. Researchers showed ways to exploit the flaws through PHP-based applications, including WordPress, Drupal, and Joomla. However, exposure varies depending on how a system is set up and how its applications work.
For Philippine users, the concern is the security and availability of services such as government registration portals and other online transactions. A successful attack could allow criminals to change website content, plant harmful files, or interrupt services.
The flaws could enable attackers to run commands on an affected server without logging in. Depending on the setup, attackers could also obtain passwords, digital access tokens, and other sensitive information held temporarily in the server’s memory.
Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws carry a severity score of 9.2 out of 10. The PHP development team issued emergency security updates on Oct. 21 after the vulnerabilities became public ahead of their planned release.
The advisory lists PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as patched releases. Organizations using software packages maintained by other vendors should confirm that the fixes are included, since version numbers may differ.
CERT-PH said the sources reviewed for its advisory did not establish a confirmed PHP2Shell compromise of a Philippine organization. However, publicly available research shows possible attack methods, and Cloudflare reported early exploitation attempts around the disclosure period.
Agencies should include outsourced websites, shared hosting, and commercial software containing PHP in their checks. Having an external provider manage a website does not remove the need to verify whether its underlying software has been patched.
Administrators should prioritize systems accessible through the internet and investigate unusual activity. Repeated server errors alone do not prove an attack. Temporary settings may reduce some risks, but CERT-PH stressed that these measures cannot replace security updates to affected PHP installations.