Two critical vulnerabilities could enable remote code execution and expose sensitive credentials, while widespread use of unsupported PHP versions complicates remediation.
Two critical vulnerabilities in PHP, one of the world’s most widely used programming languages, have raised concerns about website security, enterprise applications and the personal information they hold. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws could allow unauthenticated attackers to execute malicious code remotely on vulnerable systems.
In response, Qualys is offering its security solutions free for 15 days to help organisations identify, validate and mitigate exposure to the vulnerabilities, collectively known as PHP2Shell. The offer covers up to 1,000 assets from activation and includes capabilities across the Qualys TruRisk Platform, including Qualys VMDR, Enterprise TruRisk Management (ETM) and TruRisk Eliminate.
Both vulnerabilities carry a CVSS v4.0 severity score of 9.2 out of 10, and attack traffic has already been reported. The flaws could also expose sensitive information, including passwords, authentication tokens and API keys, through leaked PHP worker memory.
Two critical PHP vulnerabilities have put millions of website installations at potential risk, prompting Qualys to offer 15 days of free security assessment and remediation services for up to 1,000 assets. With attackers already targeting the flaws and more than 70% of analysed installations running unsupported PHP versions, the incident highlights the urgency of identifying exposure and securing vulnerable systems.
According to anonymised data from more than 10,000 customers analysed by the Qualys Threat Research Unit (TRU), researchers identified 167 million PHP package installations, 73% of which were running on internet-facing assets.
Unsupported PHP Versions Deepen the Risk
Although PHP developers have released security fixes, not all organisations can address the vulnerabilities through a straightforward update. Many continue to operate older PHP versions that have reached end of life (EOL) or end of support (EOS), leaving them without a vendor-provided patch.
Qualys TRU analysed 156 million PHP package installations with known versions. Of these, approximately 44 million, or 28%, were running vulnerable versions within supported PHP branches 8.2 to 8.5, for which fixes are available. Another 110 million installations, representing around 71%, were running unsupported versions ranging from PHP 5.4 to 8.1.
“PHP2Shell puts a large share of the web at risk, and over 70% of installations will not have a patch. With attackers already moving, security teams need to know right now whether they are exposed and how to fix it immediately.”
— Shailesh Athalye, Chief Product Solutions Officer, Qualys
The analysis also found that only 581,000 installations, or 0.37% of those with known versions, had been patched within the first 24 hours after disclosure.
These figures highlight the challenge of securing widely distributed software. Legacy business applications may depend on older PHP versions, while upgrades can introduce compatibility issues, require extensive testing or disrupt production services.
Voldemaras Kadys, Head of Security & Platform Engineering at Mediatech, emphasises that PHP’s widespread adoption makes the issue significant, but the actual risk depends on the version and configuration running on each website. Not every PHP-powered website is necessarily vulnerable.
For supported versions, organisations should apply the relevant fixes and restart PHP services to ensure the updates take effect. For unsupported installations, they should investigate operating-system vendor backports where available, isolate vulnerable systems and plan upgrades or retirement.
Qualys Offers a Discovery-to-Remediation Workflow
Qualys says its free service is designed to help security teams move from identifying vulnerable installations to verifying that corrective measures have worked.
The platform can detect vulnerable PHP installations within 60 minutes, including instances running in containers or bundled with other applications. Security teams can then prioritise internet-facing systems and legacy versions, assess exposure and determine which remediation measures are required.
For supported PHP versions, the recommended approach is to apply the appropriate patches and restart the relevant services. For unsupported versions, organisations may need to use available backported fixes, restrict access or isolate affected systems while planning longer-term upgrades.
“The release of a security update does not mean every website is automatically safe. Website operators and hosting providers must install the fixes themselves, and delays could leave vulnerable systems exposed to attackers.”
— Voldemaras Kadys, Head of Security & Platform Engineering, Mediatech
A subsequent rescan helps confirm whether identified exposures have been closed.
“PHP2Shell puts a large share of the web at risk, and over 70% of installations will not have a patch,” said Shailesh Athalye, Chief Product Solutions Officer at Qualys. “With attackers already moving, security teams need to know right now whether they are exposed and how to fix it immediately. Qualys is making our services available so organizations can find, prioritize and close these exposures before they are exploited.”
Organisations can access the 15-day free service for up to 1,000 assets at qualys.com/php2shell-risk-assessment.
Customer Data and Credentials Also at Risk
Successful exploitation could allow attackers to compromise website servers, modify content, install malware, steal information or disrupt online services. The potential consequences depend on the affected system, its permissions and the extent of an attack.
Credential exposure is a particular concern. Stolen passwords, authentication tokens and API keys could provide access to connected applications or other systems if they remain valid and carry sufficient privileges. Organisations investigating potentially compromised servers should therefore review suspicious activity and consider rotating exposed credentials.
For online retailers, booking platforms and business portals, the consequences could include exposure of customer records, service disruption and recovery costs.
Kadys cautions that simply visiting a PHP-powered website does not automatically mean a user’s device will be compromised. The more direct concern is that attackers could exploit a vulnerable website to access personal information stored by the service.
Exposed details such as names, email addresses, physical addresses and dates of birth could subsequently be used in phishing, impersonation and other scams. Users should remain cautious about unexpected messages requesting sensitive information and follow official guidance if a service confirms a breach.
A Reminder About Enterprise Vulnerability Management
PHP2Shell underscores the importance of maintaining an accurate inventory of software across servers, containers, cloud environments and third-party applications. Organisations must know which PHP versions they use, identify unsupported installations and establish clear responsibility for patching.
Security teams should also verify that fixes have taken effect and investigate whether vulnerable systems were compromised before remediation. Where immediate patching is not possible, restricting access and isolating exposed workloads can help reduce risk.
Qualys’ initiative provides a time-limited opportunity for organisations to assess their exposure and validate remediation. The broader lesson is that security updates are only the first step: effective protection requires continuous discovery, prioritisation, remediation and verification.