Security Oct 2026

New reports describe a set of PHP vulnerabilities known as PHP2Shell. If your company website, online store, or internal system runs on PHP, this concerns you. You don't need the technical details, but you do need to know which questions to ask and whom to ask.

According to The Hacker News, attackers abused two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and then used agentic AI platforms for the post-exploitation stage. In the case the report describes, the target was a government entity in Europe. Within two hours of initial exploitation, the report says, the attackers had reached password hashes and information related to multi-factor authentication. The practical lesson is that the gap between "breach" and "serious damage" can shrink from days to hours.

The story doesn't end with those two flaws. The Register and BleepingComputer report a third one: a remote code execution vulnerability affecting systems with non-default configurations. It will not get an emergency patch, and the PHP security team has only published mitigation measures. So "just update the server" is no longer a sufficient answer.

This matters even more in Iran, where PHP underpins a large share of the web: WordPress, Laravel, and custom systems that an agency built years ago. Many of these sites run on shared hosting or on servers where someone else decided the PHP version and settings. Sometimes the original developer is unreachable and nobody knows exactly what is installed. In a crisis, that kind of uncertainty wastes the most time.

The first three questions are about knowing what you own. First, what is the complete list of PHP-based systems, including the main site, admin panels, old sites, and forgotten test environments? Second, which PHP version and which framework or CMS does each one run, and who is responsible for updating it? Third, have any non-default settings been applied on these servers? Since the unpatched flaw depends on such configurations, the answer tells you whether you are exposed.

The next two questions are about action and monitoring. Fourth, for systems that might be affected, what temporary mitigation has been put in place, who approved it, and when will it be reviewed? Fifth, who is watching the logs? They should also be stored somewhere other than the server itself, with alerts for unusual behavior such as logins at odd hours or unfamiliar commands. If an MSP partner handles this, check that your service agreement explicitly covers this monitoring.

There is no need to panic this week, but it is wise to ask your technical team or MSP partner for a short written answer: the list of systems, versions, configuration status, and interim measures. Also ask what happens if signs of compromise appear, including the order for rotating passwords and keys, restoring from a clean backup, and informing people internally. Having those answers before an incident does more than anything else to speed up your response.

Start a project