PHP data breach

A worldwide cybersecurity warning was triggered by the discovery of two major remote code execution (RCE) vulnerabilities in the core PHP language runtime that were evaluated 9.2 in severity and together referred to as "php2shell" (recorded as CVE-2026-109618 and CVE-2026-109619).

The Weakness• What happened: Unauthorized remote code execution and memory disclosure were made possible by two PHP memory management and error handling vulnerabilities.• Impact: Attackers may be able to take over web servers, open backdoors, and steal confidential information due to the vulnerabilities that affect PHP servers on a large percentage of the internet.• Discovery: Before updates were coordinated, researchers from Wiz, Calif, and OpenAI used AI-assisted security scans to find the vulnerabilities that had been present in the source for more than ten years.

Worldwide Reaction and Measures• Patches: Official security fixes were made available by the PHP Group. It is recommended that organizations update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 right away.• CISA Status: Following reports of ongoing exploitation efforts, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities (KEV) Catalog.• Offline Measures: A number of government organizations, public services, and business platforms temporarily took vulnerable websites offline or disabled internet-facing administrative interfaces in response to the spike in millions of scanning and exploitation attempts.

Source: Pixabay img

What You ought to do:1. Inventory Systems: Verify whether all web applications, servers, and content management systems use unpatched or unsupported PHP versions.
2. Apply Patches: Update your PHP installation to the most recent patched versions right away.
3. Examine Advisories: Consult the Australian Cyber Security Center's guidelines or read the complete technical analysis and mitigation instructions on the CISA Alert on PHP Vulnerabilities.•PHP: What is it, and why did it cause a worldwide panic about cyber security?What is PHP, and why did it cause a worldwide panic about cybersecurity? Six days ago, Liv McMahon, Te. shared, saved, and added as preferred on Google.• NSA (.gov), the National Security AgencyNSA Advisory: Important PHP Patches Suggested...Whenever possible, all users should quickly inventory the hardware and software services that depend on the now-vulnerable PHP version.• Google Cloud Addressing CVE-2026-109618, a core PHP vulnerability...On October 22, 2026, we updated the blog with updated Security Command Center and Cloud Armor guidelines.

#The October 2026 PHP2Shell Crisis• What exactly happened: Two serious PHP vulnerabilities (rated 9.2/10 in severity) were revealed by researchers on October 21, 2026.• The Risk: The vulnerability gives unauthenticated remote attackers the ability to run code directly on web servers, potentially giving them complete access to backend databases.• Effect on the Web and Banking: Global banks, financial apps (like those that have been suspended in Japan), e-commerce platforms, and government services rushed to take systems offline or patch installations since PHP powers a significant portion of the web infrastructure.• Official Guidance: National Cyber Security Center and other security organizations

# State Bank of India (SBI) Dark Web Leak• What happened: Around the same period in October 2026, India's largest public-sector lender, SBI, confirmed an investigation into a data exposure after threat intelligence alerts from CERT-In and the Defence Cyber Agency.• Extent of Exposure: An analysis identified 3,897 SBI customer records (containing names, mobile numbers, emails, addresses, loan details, and banking identifiers) embedded within a larger dark web dataset of roughly 3.75 lakh records.• Bank Status: SBI stated that its core banking systems remain safe and operational, and an independent cybersecurity probe was launched

#Cryptographic Flaw in eMudhra• What happened: Eight intermediate digital certificates were impacted by a key-generation problem that certifying authority eMudhra revealed in April 2025.• Impact: The vulnerability necessitated the revocation of intermediate keys to stop possible website impersonation or faked certificates, even though the company's core infrastructure was unaffected.