The PHP project has released patches for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, after multiple cybersecurity companies reported seeing exploitation attempts before the fixes were published. While the source report is brief, the combination of active attack activity and a widely used web technology makes this a development that European businesses should treat seriously.

What happened

According to SecurityWeek, several security vendors detected exploitation attempts targeting CVE-2026-109618 and CVE-2026-109619 before PHP released patches. The report refers to the issue set as “PHP2Shell”, indicating a potentially severe path from a PHP vulnerability to server compromise.

Based on the source, the confirmed facts are limited to two points: patches have now been released, and attempted exploitation was observed before patch availability. The report does not, by itself, confirm how many systems were affected, whether compromises were successful, or which business sectors were targeted.

Why it matters for European businesses

PHP remains widely used across business websites, content platforms, e-commerce stores and custom web applications. Many SMEs rely on PHP directly or indirectly through platforms, frameworks, hosting environments and third-party plugins. That means a serious PHP vulnerability can affect not only in-house development teams, but also companies that assume their website stack is fully handled by an agency, software vendor or hosting provider.

The practical risk is straightforward: if attackers can exploit a vulnerable PHP environment on an internet-facing server, they may be able to disrupt operations, access data, alter website content or use the affected system as a foothold for broader compromise. For e-commerce businesses, that can mean storefront disruption, account risk, fraud exposure or damage to customer trust. For service businesses, it can affect lead generation, web forms, customer portals and internal applications exposed to the internet.

This is also relevant from a resilience and compliance perspective. Businesses subject to contractual security obligations, cyber insurance requirements, or sector-specific rules may need to show that critical security patches are applied promptly and that internet-facing services are monitored for signs of exploitation.

Who may be affected

• Companies running PHP-based websites or applications, including custom business portals and internal tools exposed online.
• E-commerce operators whose storefronts or supporting systems depend on PHP components.
• SMEs using CMS platforms or hosted applications built on PHP, even if they do not manage the stack themselves.
• Digital agencies and IT providers responsible for maintaining client websites, servers or managed hosting environments.
• Businesses in regulated sectors where service availability, incident handling and evidence of patch management are important.

What companies should consider

• Identify exposure quickly. Confirm whether your websites, applications, containers or server images use affected PHP versions.
• Apply vendor patches as a priority. If patching depends on a hosting provider, managed service provider or software vendor, request confirmation of their remediation status.
• Review internet-facing systems for suspicious activity. Because exploitation attempts were reportedly seen before patches were released, organisations should not assume that patching alone is enough.
• Check logs and detection tools. Web server, application and endpoint logs may help identify unusual requests, failed exploitation attempts or signs of post-exploitation activity.
• Validate recovery readiness. Ensure backups, restoration procedures and incident response contacts are current in case a server needs to be rebuilt or isolated.
• Review third-party dependencies. If your business uses PHP through packaged software, CMS deployments or agency-managed environments, verify whether upstream maintainers have issued updates.
• Document actions taken. For businesses with governance, insurance or compliance obligations, keep records of exposure assessment, patch timing and any follow-up investigation.

For many European businesses, the main lesson is operational rather than theoretical: when a core web technology receives patches after pre-disclosure exploitation attempts, update cycles need to move quickly. Even organisations without in-house developers should treat this as a supply-chain and hosting security issue, not only as a developer problem.