Two critical vulnerabilities in PHP, the programming language behind more than 70% of websites worldwide, were disclosed this week under the name PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Rated 9.4 out of 10 in severity, they allow an attacker to take full control of a website remotely, with no username or password, and they are already being exploited. This article explains what that means in plain language, and what you should do today.
What is PHP, and why does this concern you?
PHP runs most websites behind the scenes. Think of it as the car engine: you never see it, but nothing moves without it. WordPress, most online stores, and many organisation and association websites in Bahrain are built on it. If you run a website of any kind, there is a high chance it depends on PHP.
What happened?
The flaw is not in any single website. It is in the PHP engine itself, which means every site running an unpatched version is exposed, even if it was built correctly. The first vulnerability lets an attacker overwhelm PHP's memory by sending a specially crafted file upload request. The second is a bug in how PHP resets session data between requests. Combined, they allow the attacker to run their own commands on the server.
Once inside, an attacker can steal data, deface the website, plant malware that infects visitors, or use the server to attack others. Proof-of-concept exploits are public, and Cloudflare has confirmed exploitation attempts in the wild.
Is my website affected?
If your site runs PHP and has not been updated this week, the answer is most likely yes. All versions back to PHP 5 are affected on default settings. The safe versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; anything lower is exposed. To find your version in WordPress, go to Tools, Site Health, Info, then Server. In cPanel look for "Select PHP Version", in Plesk open PHP Settings under your domain, and on your own server run php -v. If none of that is familiar, simply ask your developer or hosting provider which PHP version your site runs on.
What to do now
First, back up the website and its database before any change. Second, update PHP to the latest safe version through your hosting control panel or your developer; on Ubuntu and Debian servers the patched packages are already in the standard updates. Third, if you cannot update today, enable Cloudflare or any web application firewall as a temporary shield, and set session.upload_progress.enabled = Off in php.ini as a partial mitigation. Fourth, after updating, change your admin passwords and review the site for any unfamiliar files or changes.
Signs that a site may already be compromised include unfamiliar new .php files, strange pages, sudden slowness, visitors being redirected elsewhere, or a warning from Google. If you notice any of these, take the site offline temporarily and contact a specialist.
Tools and resources
We prepared a one-page printable checklist in Arabic and English that walks through the four steps above: download the PHP2Shell protection checklist (PDF). The official patched releases are listed at php.net/downloads, and the free Pentest-Tools PHP2Shell scanner can check whether your public site is still vulnerable after you update.
Why is a first aid team talking about cyber security?
Because safety does not stop at the edge of the pavement. The Techno Committee at Life Pulse builds and maintains the team's digital platforms, and part of our role is sharing what we learn with the community. Most websites that get compromised this week will belong to people who never heard about the vulnerability. One message from you to an organisation you know could save them a serious loss. Questions about this alert or digital safety in general are welcome at techno@lifepulse.bh.
Sources: SANS Internet Storm Center and Wiz vulnerability database.