Pakistan’s National Computer Emergency Response Team (National CERT), the government’s cyber security team, has told everyone running a PHP website to update right away. The warning follows a critical PHP vulnerability that lets hackers take over a web server without a password.
PHP is the computer language behind WordPress, Joomla, Drupal and many other website tools. Security company Wiz, which helped find the problem, says PHP runs about 70% of the world’s websites.
The problem is two linked flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”. Each is rated 9.2 out of 10 for danger. The PHP team released fixed versions on October 21, 2026, and asked all users to update immediately.
| If your site runs | Update to |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 or older | No fix coming; move to a newer version |
Government sites, banks and online shops told to act
The National CERT advisory names federal and provincial government websites, banks, online shops, web hosting companies and any organization with a public PHP website. It says hackers could use the flaws to steal customer data and passwords, hide harmful files on servers, change what a website shows, or shut it down.
Wiz says nearly every PHP version from the last 10 years is affected, going back to PHP 5.4. In its tests, Wiz took control of WordPress, Drupal and Joomla sites without logging in. It also showed that hackers could read passwords and secret keys straight from a server’s memory.
Even a very simple website can be at risk. The fault is in PHP itself, not in the website’s own code.
In the US, the National Security Agency (NSA) also posted a warning on October 21, telling organizations that use PHP to get ready to update.
Updating WordPress alone will not fix it
This is the point many small website owners could miss. National CERT says updating WordPress, Joomla, Drupal, Magento or their plugins does not solve the problem. The fix has to happen on the server where PHP is installed.
For most small businesses, bloggers and shops in Pakistan, that server belongs to a hosting company. Start by checking your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. Most hosting control panels, such as cPanel, also show it.
If your version is below the fixed one in the table, ask your hosting company to update PHP. Some hosts let you switch the version yourself from the control panel. After the update, open your site and check that it still works properly.
Sites on PHP 8.1 or older are in a harder spot. No official fix is coming for them. National CERT says they should move to a newer PHP version, or be kept off the public internet until they do.
For server managers, the advisory lists two temporary settings: turning off “session.upload_progress.enabled” and turning on “session.use_strict_mode” in the php.ini file. National CERT stresses these only lower the risk and are no replacement for the update.
Anyone who thinks their site has been hacked can report it to National CERT through pkcert.gov.pk/report-incident, by email at cert@pkcert.gov.pk, or on UAN 051-9203412.
Bug details leaked a day early
According to the PHP Foundation, the group that supports PHP, the bug numbers began spreading on social media on October 20, a day before the planned release. One of the security firms then posted a video of its attack by mistake, and copies spread online.
The PHP Foundation said this sped up efforts to build working attacks, though it had found no working one by release time. National CERT’s advisory, citing internet company Cloudflare, says early attacks were reported on October 21.
AI cracked a problem hidden for years
The weakness was not new. The PHP Foundation says the first signs appeared during a security check in 2024, but work on a fix kept stalling for months. It called the delay “a structural failure”.
What changed this year was artificial intelligence. Security firm Calif reported a working attack in August through Patch the Planet, an OpenAI program, and OpenAI’s own team found the same root problem. Wiz used Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol in its research.
Wiz says AI let one researcher do in a week what once took a top team months. It also warned that the same tools can help hackers adjust their attacks for different websites, which is why updating quickly matters.
