Issued 22 October 2026 | Severity: Critical | CVE-2026-109618, CVE-2026-109619
The Eswatini Communications Commission (ESCCOM) urges all organisations running PHP-based websites and systems to update PHP immediately.
Two critical vulnerabilities in PHP, together known as PHP2Shell, allow attackers to take control of web servers without logging in. The flaws were disclosed on 21 October 2026, and attacks are already being reported worldwide. Exploit code is publicly available.
Who is affected? Any website or application running on PHP version 5.4 or later. This includes popular platforms such as WordPress, Joomla, Drupal and Magento, as well as government, banking and customer portals.