Explainer Series: PHP2Shell, explained in five parts
Two critical flaws (CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10) in PHP, which is used by almost 70% of websites, let attackers run code on a server without logging in. Facts as of 23 October 2026; the story is still developing.
1 What happened
On 21 October, Finland’s government website was partly disabled, Oxford and Edinburgh city councils went offline, some BBC programme pages became unavailable, and the Office for Budget Responsibility took its site down. PHP said there were no complete mitigations, and the UK’s NCSC told organisations that could not update fast to consider going offline. Fixes arrived at 14:00 UTC (7:30 pm IST), but Cloudflare’s CEO said there were already thousands of exploit attempts in the ten hours before the announcement, and millions after.
2 What is broken
Two memory-handling bugs. In the first, PHP runs out of memory mid-request and later treats half-built data...
Copyright of this story solely belongs to www.expresscomputer.in. To see the full text click HERE
