Threat Intelligence

Two Critical PHP Flaws Under Attack: What Businesses Running PHP Need to Know

Dark Reading · 22 Oct 2026

Key Takeaway Ask your web developer or hosting provider today whether your PHP-based systems are affected, and apply any available security updates as soon as possible.

Security teams are working to fix two critical vulnerabilities in PHP, a programming language widely used to run websites and web applications. The flaws have been nicknamed 'PHP2Shell', and Dark Reading reports they have prompted a red alert across the security industry.

The urgency comes from two developments: details of the bugs have leaked, and there are reports of attempts to exploit them. When technical details become public, attackers can move quickly to target organisations that have not yet applied fixes.

The source summary does not give technical specifics, affected versions or patch details. Businesses that run PHP-based websites, online stores or content management systems should check with their web developer or hosting provider about their exposure and whether updates are available.

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.