Bangladesh e-Government Computer Incident Response Team (BGd e-GOV CIRT) has issued a high-severity alert over two critical security vulnerabilities in PHP, a programming language widely used to build websites and web applications.
The vulnerabilities, collectively dubbed “PHP2Shell”, could allow hackers to remotely run malicious code on vulnerable servers without a username or password, potentially giving them control of affected systems.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a Common Vulnerability Scoring System (CVSS) score of 9.2 out of 10, placing them in the critical severity category.
According to the alert, the vulnerabilities stem from PHP’s memory management. Attackers could exploit situations involving memory exhaustion or data persisting from previous requests after memory is freed by sending specially crafted HTTP requests to gain control of a server.
Users of PHP-FPM and Apache’s mod_php are particularly at risk. Other potentially affected systems include PHP-CGI, FrankenPHP, LiteSpeed, Docker containers and shared hosting environments. Government portals, banks, e-commerce platforms and websites built on WordPress and Laravel could also be vulnerable.
A successful attack could result in full server compromise, data and file theft, exposure of database passwords and API keys, and website outages, the alert warned.
BGD e-GOV CIRT has urged administrators to update PHP immediately to the secure versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It also advised them to ensure that the server’s underlying PHP runtime is updated, not just the application framework.
For administrators unable to install the patches immediately, the agency recommended temporarily placing servers behind a VPN, restricting access through IP-based allowlists and increasing log monitoring.
However, BGD e-GOV CIRT stressed that updating PHP is the only permanent solution.
