Bangladesh's e-Government Computer Incident Response Team has issued a high-severity alert over two critical flaws in PHP, the server software that runs a large share of the world's websites, warning that unpatched government portals, bank sites and online shops could be taken over remotely.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, became public on 21 October. Both carry a CVSS severity score of 9.2 out of 10, inside the critical band. The PHP project, the volunteer group that maintains the language, released emergency updates the same day.

The problem is not in any single website's code but in the PHP runtime itself. When PHP handles a request it reserves memory, and normally releases it when the work is finished. In the first flaw, a request that hits the memory limit is interrupted before some internal data has been fully set up, and the cleanup routine later treats that unfinished data as if it were valid. In the second, a fatal error leaves references to memory that has already been freed, and a later request handled by the same worker can follow those stale pointers.

In both cases an attacker can send a specially crafted HTTP request and, under the right conditions, run their own commands on the server without a username or password. Because the weakness sits in the interpreter, updating a content management system, plugin or theme does not fix it. The PHP runtime on the server has to be replaced.

BGD e-GOV CIRT said users of PHP-FPM and Apache's mod_php are at particular risk, with other exposure in PHP-CGI, FrankenPHP, LiteSpeed, Docker containers and shared hosting. It listed government portals, banks, e-commerce platforms and sites built on WordPress and Laravel as potentially vulnerable. A successful attack, the alert said, could mean full control of a server, theft of files and data, exposed database passwords and API keys, and outages.

The agency told administrators to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and to check the runtime underneath the application rather than only the framework. Where patching cannot happen at once, it advised putting servers behind a VPN, restricting access with IP allowlists and increasing log monitoring. It stressed that updating is the only permanent fix.

The PHP project went further in its own advisory, publishing temporary settings that block known attack paths. They include removing the memory limit, lowering the maximum accepted request size, switching off session upload progress and, on PHP 8.5, turning off fatal error backtraces, followed by a restart of every worker. The project was explicit that these measures reduce exposure but do not make a server safe.

Outside Bangladesh, the disclosure set off a wave of precautionary shutdowns. The Dutch national cyber security centre, the Port of Rotterdam, hospital websites and the sites of the Netherlands' five largest political parties went offline, according to Reuters reporting cited by The Daily Star. Finland closed government public web services, France's interior ministry put its sites into maintenance, and Denmark's Kombit shut several services including a national school communication platform. Wikimedia took some systems offline and the Internet Archive briefly went dark.

The scale is what made the response so broad. W3Techs, which surveys web technology, estimates PHP powers 69.3 percent of websites whose server-side language can be identified. Wiz, one of the security firms involved in the discovery, said the bugs ranked among the most severe ever found in PHP. Censys data cited by Reuters found about 1.5 million of 2.6 million hosts reporting PHP versions for which no fix was available at the time.

There were also signs that attackers moved before defenders did. Amazon's security chief, CJ Moses, said the company detected an attempted exploit against a decoy system on 17 October, four days before public disclosure, and that the flaws were later being broadly exploited in the wild. Amazon could not say whether the earlier attempts would have worked against real sites.

For Bangladesh, the practical risk is concentrated in small and medium organisations that rent space on shared hosting and rely on the provider to keep software current. Such operators often have no security staff of their own, and may not know which PHP version their site is running. The same applies to many school, clinic and union council websites built years ago and never touched since.

What is not yet known is whether any Bangladeshi site has actually been breached. The CIRT alert describes the danger and the fixes but does not report a compromise, and no government list of affected sites has been published. It is also unclear how quickly local hosting companies have applied the updates, or whether older installations on end-of-life PHP branches will be migrated at all.

The PHP project has said it will not issue further releases for PHP 8.1 and older, though it published source-level backports for 7.4, 8.0 and 8.1 and asked users to check their distribution or support vendor. Sites still on PHP 5 or 7 without a vendor fix remain exposed for as long as they stay online.

The immediate test is administrative rather than technical. Website owners need to confirm their PHP version, ask their host what has been patched, and recheck after any change, because container images and old workers can keep running vulnerable code after an update is installed elsewhere on the machine. Security agencies in several countries have also warned that phishing messages citing the incident are likely, since panic over a patch is itself an opening for attackers.

For readers, there is little to do beyond normal caution: treat unexpected emails or messages about the PHP flaw as suspect, and avoid entering passwords after following a link from one. For the agencies and companies running the affected sites, the window between disclosure and exploitation is already open.