• October 21, 2026
• Written by: 9hcqj
• No Comments

“Whoever fights monsters should see to it that in the process he does not become a monster.” — Friedrich Nietzsche

On October 20, details of two critical PHP vulnerabilities leaked onto the internet before a fix existed. By the time the patches shipped the next morning, every attacker with a scanner already had a head start.

The flaws are called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). If you run a website, or your business trusts any website at all, this one is about you.

What happened

PHP is the engine underneath a huge share of the web. It powers WordPress, Drupal, Joomla, most shared hosting, and many of the sites your staff log into every day.

Security researchers from Calif, Wiz, and OpenAI found two bugs that let an attacker run their own code on a PHP server without logging in. In the worst case, a single crafted web request triggers the attack before the website’s own code even starts. No password and no user interaction are needed.

In plain terms:

• CVE-2026-109618 abuses how PHP handles running out of memory. It leaves internal data half-built, and PHP then trusts that broken data.
• CVE-2026-109619 abuses leftover data from one visitor’s request that should have been cleaned up but gets reused by the next one.

Wiz demonstrated the attack against WordPress, Drupal, and Joomla. They also showed a separate path that can leak passwords, API keys, tokens, and certificates straight out of server memory.

The PHP team released fixed versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) on October 21 and said there are no complete workarounds. There are no patches for PHP 5 or 7. Servers on those versions cannot be fixed, only replaced.

Why this hits harder

The companies with patch pipelines will update this week. The real damage will be in the long tail:

• The WordPress site an agency built in 2019 and nobody has touched since
• Cheap shared hosting running PHP 7 because “it still works”
• School, NGO, and government portals with no security team
• SME websites where the “IT person” is whoever knows the password

Across Nigeria and the rest of the continent, that long tail is most of the web. Expect mass scanning within days, and expect thousands of legitimate local websites to be quietly taken over.

The part nobody is talking about: phishing

When attackers compromise a website, they rarely deface it. They use it.

A hacked site is a perfect phishing host. It has a real domain, a real padlock icon, a history, and a good reputation with email filters. Attackers will plant fake login pages, payment pages, and malware downloads on websites your staff already trust: a supplier’s portal, a school’s fee page, a local news site.

This breaks one of the oldest pieces of security advice: “check the URL.” When the URL is genuinely your vendor’s domain, checking it isn’t enough.

What your team needs to recognise now is behaviour, not just addresses:

• A familiar site suddenly asking you to log in again, re-enter card details, or “verify” your account
• A trusted page pushing a download you didn’t ask for
• A link from a known contact on WhatsApp or SMS leading somewhere unexpected, even on a real domain
• Urgency: “your access expires today,” “payment failed, retry now”

What to do this week

If you run websites:

1. Find every PHP server you own, including the forgotten ones. Check the version.
2. Update to a patched release immediately. Start with anything internet-facing, especially WordPress and Apache with mod_php.
3. If you’re on PHP 5 or 7, plan a migration now. There is no patch coming.
4. If a server was exposed between October 20 and when you patched, rotate the secrets it held: database passwords, API keys, payment gateway keys, certificates.
5. Ask your hosting provider, agency, or developer directly: “Are we patched for PHP2Shell?” Get the answer in writing.

If you run a team:

1. Tell your staff today that trusted websites may be compromised for the next few months.
2. Teach them to judge the request, not just the address.
3. Give them a fast, no-blame way to report something that feels off.
4. Test them. Awareness that’s never tested is just hope.

Train where they work

Patching fixes your servers. It doesn’t fix the moment an employee lands on a compromised supplier site and types in their credentials.

That moment is what we train for at Firmgrip. We run localized phishing simulations across email, WhatsApp, and SMS, in English, French, Pidgin, and Nigerian languages. The training is delivered where your people actually spend their day. We’re adding scenarios built on exactly this pattern: real-looking domains, familiar brands, and requests that should feel wrong.

Train where they work. Test where they’re attacked.

Of course, you could just hope your team spots the next one on their own. Most companies do, right up until the incident report.

If you’d rather not, see how Firmgrip works.

Stay sharp, patch fast, and look out for each other. Hackers are ruthless; we want you to be rootless.

Yuso cooked!

---

Sources: BleepingComputer, Huntress, Laravel News, watchTowr