PHP2Shell: Critical Vulnerabilities Actively Exploited

PHP2Shell: Critical Vulnerabilities Actively Exploited

•

Episode description

PHP2Shell: Critical Vulnerabilities Actively Exploited

Two critical PHP vulnerabilities, CVE-2026-1096118 and CVE-2026-1096119, both scored 9.8 out of 10, were patched on 21 October 2026. Within hours, attackers began probing for unpatched servers. These flaws allow unauthenticated remote code execution on vulnerable PHP installations, affecting WordPress, WooCommerce, Magento and countless UK small business websites. The vulnerabilities involve memory corruption and stale global state handling. Emergency patches are available for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Cloudflare reported early exploit attempts the same day patches released. CrowdStrike and SentinelOne published guidance immediately. No confirmed breaches have been publicly reported, but absence of disclosure does not mean absence of compromise. UK small businesses must verify their PHP version today, contact hosting providers or MSPs for patch confirmation, and obtain written evidence of remediation. This episode provides specific, actionable steps for business owners to protect their web infrastructure and strengthen their Cyber Essentials certification posture.

Chapters

  • Intro Corrine introduces two critical PHP vulnerabilities with 9.8 severity scores, already being actively exploited following patch release.
  • PHP2Shell: Active Exploitation of Critical Web Vulnerabilities Detailed examination of CVE-2026-1096118 and CVE-2026-1096119, covering what PHP is, who’s affected, the technical nature of the memory corruption flaws, the timeline of exploit attempts, and specific remediation steps for UK small businesses.
  • CTA Request for listeners to follow, rate and share the show within the small business community.
  • Outro Summary of immediate actions required: contact server management provider, verify PHP version, obtain written confirmation of patching.

Links