Two serious flaws in PHP, the software behind roughly 70% of websites, are now being exploited by attackers. CISA added them to its Known Exploited Vulnerabilities list on 26 October 2026.

• What it is: Two remote code execution flaws (CVE-2026-109618 and CVE-2026-109619), known as PHP2Shell, that let an attacker run their own commands on a web server.
• Who is affected: Any business running its own website or web application on PHP, including WordPress sites and hosted web servers that have not applied the PHP security updates released on 21 October 2026.
• The risk: Attackers began targeting the flaws before patches were available, and several security vendors have since detected exploitation attempts. More than 5 million PHP hosts are exposed online.
• A second issue: A separate unpatched PHP flaw (CVE-2026-115560) was disclosed on 23 October. The PHP team has published mitigation guidance for it.
• Action needed: Install the latest PHP security update on every web server, and ask your web host or developer to confirm it has been done.

We recommend businesses confirm their PHP version this week, and contact us if you are unsure whether your website or hosting is covered. Source: BleepingComputer.