PHP vulnerabilities prompt preventive shutdowns of Swedish systems
Two critical vulnerabilities in the widely used programming language PHP allowed potential unauthorized server access without login credentials last week, prompting international authorities and municipal systems to temporarily shut down web services. While preventive shutdowns caused widespread disruption, cybersecurity authorities confirmed that the flaws have not been exploited on a broad scale.
Municipal Preventive Measures and Internal Crises
Municipalities across Sweden responded swiftly to the initial alerts. In Umeå, local administration closed several systems preventively upon learning of the vulnerabilities, svd.se reported. Operations managers noted that the incident required several weeks of follow-up work to upgrade systems, though most services have since been restarted.
Södertälje municipality activated its central crisis management team in response to the digital threat environment. Anledningen till att vi gjorde det var att vi såg en överhängande risk utifrån vår digitala miljö,
says security manager Emir Gazibegovic. Security management reviewed all systems and servers, finding no recorded damage or signs of unauthorized entry. While authorities deemed the digital risk severe enough to warrant emergency protocols, subsequent reviews confirmed that the threats did not materialize into actual breaches.
> This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit’s offsets appears in the subsequent…
PHP Vulnerabilities Allow Attackers to Seize Stored Data
PHP, originally an acronym for Personal Home Page, was created over thirty years ago to simplify web development by combining with standard HTML code. Today, the language underpins numerous major content management systems and blogging tools, including WordPress, Joomla, and Drupal. The newly discovered vulnerabilities enable attackers to send malicious requests to unauthenticated servers and seize control of stored data. The entire issue was initially discovered by Perplexity security researcher Adel Karimi, who utilized honeypots to detect them.
Developers addressed two specific vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, through emergency security updates on October 21. Security researchers subsequently confirmed that these flaws were being utilized in real attacks against Apache servers running PHP version 8.4.26, a finding also confirmed by Expel security researcher Marcus Hutchins according to Bleeping Computer reports. Meanwhile, PHP security teams noted that an additional vulnerability, CVE-2026-115560, still lacks a deployed patch.
Rapid Warnings Prevent Widespread Exploitation of Security Flaws
The Nationellt cybersäkerhetscenter reported receiving multiple incident reports, though the vast majority involved organizations executing recommended preventive measures rather than addressing active breaches. Although numerous attempts were launched against vulnerable servers, they failed to achieve widespread success. Officials attribute the limited impact to rapid public warnings that enabled organizations to deploy necessary defenses before large-scale exploitation occurred. Hackers have so far failed to exploit the security flaws on any major scale, notes John Billow, head of the Nationellt cybersäkerhetscenter, who adds, Vi kommer nog att behöva vänja oss vid den här typen av sårbarheter.
Cyberbarhetsexperten Henrik Bergqvist at Cisco notes that the consequences have turned out betydligt mindre än vad den initiala oroande bilden antydde.
Security experts emphasize that automated code analysis tools will likely uncover similar software flaws with greater frequency moving forward.
Seeing some anecdotal reports of successful php2shell exploitation in the wild, but also seeing a lot of people mistaking old exploits for php2shell. I'd say it's fairly likely there's at least some exploitation going on, but all the people I'd usually confer with for a second…