Baku:The National Cybersecurity Agency (NCA) of Azerbaijan, operating under the Ministry of Digital Development and Transport, has issued a warning regarding two critical security vulnerabilities found in the PHP programming language, known as “PHP2Shell.”
According to Azeri-Press news agency, these vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been rated 9.2 out of 10 in terms of severity. They allow attackers to execute arbitrary commands on a server remotely by sending a specially crafted request, without needing a username, password, or other security credentials. This makes it possible for widespread and easy attacks.
PHP is extensively used in websites and web applications, including popular platforms like WordPress, Joomla, and Drupal. The vulnerabilities pose a risk to any system using PHP, potentially affecting a large proportion of websites globally. An attacker could gain control of a server, install malicious files, steal credentials and personal data, alter website content, and use compromised servers to attack other systems.
The NCA has advised website owners, hosting providers, and organizations to update PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, check for suspicious server activities, and isolate compromised systems. Reporting incidents to the National CERT and applying regular security updates are also recommended.
International statistics indicate that approximately 70% of the world’s most visited websites use PHP, with WordPress being a significant user. Thus, a substantial portion of these websites could be at risk due to these vulnerabilities.