Rabat – Morocco’s General Directorate of Information Systems Security (DGSSI) has issued a critical warning over two PHP vulnerabilities known as “PHP2Shell,” saying they could allow remote attackers to run arbitrary code on affected servers.
The Moroccan cybersecurity authority published the bulletin on Wednesday under reference number 69782110/26. It lists the risk and impact as critical and identifies the flaws as CVE-2026-109618 and CVE-2026-109619. The bulletin says proof-of-concept exploit code is available, increasing the risk that vulnerable systems could be compromised.
The PHP advisories describe one flaw as remote code execution through out-of-memory corruption and the other as remote code execution linked to stale global state. Both vulnerabilities were rated 9.2 under version 4.0 of the Common Vulnerability Scoring System in an alert published by NHS England Digital. Successful exploitation may also expose sensitive data held in PHP process memory.
Read also: Critical Cybersecurity Flaws Prompt Websites Worldwide to Go Offline
The vulnerabilities affect PHP, a widely used programming language for building web applications and dynamic websites. DGSSI said affected environments include PHP-FPM, Apache configurations using mod_php, php-cgi, FrankenPHP, and LiteSpeed. It also warned that PHP 8.1 and older releases are no longer supported and recommended migrating to a maintained version.
The PHP development team released security updates yesterday, fixing both flaws in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The team said all PHP installations serving web requests are at risk and urged users to update immediately. It added that mod_php faces the highest risk because a demonstrated exploit can be triggered by an unauthenticated request before application code runs.
The US National Security Agency (NSA) also issued an advisory yesterday, urging organizations to identify systems relying on vulnerable PHP versions and apply vendor patches. The NSA said the flaws could allow attackers to take control of affected web servers without prior access or authentication, potentially enabling them to steal sensitive data, disrupt services, or move further into a network.
The agency advised organizations to increase logging and consider replacing PHP services that have reached end of life. If an immediate update is not possible, it recommended taking affected systems offline until they can be secured. The NSA said malicious cyber actors are likely to weaponize the vulnerabilities and called for immediate patching across US government departments and agencies.
The PHP team said updating to a fixed release is the only complete solution. Organizations running older versions should check with their software distributors, as some Linux distributions and long-term support vendors may provide backported fixes.
