Morocco’s cybersecurity authority has issued a critical warning over two security vulnerabilities affecting PHP, a programming language widely used to run websites and online applications. The flaws could allow hackers to execute malicious code remotely on vulnerable servers, potentially exposing sensitive data.
The General Directorate for Information Systems Security (DGSSI), which operates under the National Defence Administration, published its alert on October 21. It classified both the risk and potential impact as critical.
Two flaws could expose vulnerable servers
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are known collectively as “PHP2Shell.” They could allow attackers to execute code on affected servers without first logging in.
If exploited, the flaws could compromise server security, expose confidential information or disrupt online services. The risk also extends to organisations whose websites and applications rely on affected PHP configurations.
The DGSSI identified several potentially affected environments, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
However, the warning does not mean that all websites using PHP have been compromised. The actual risk depends on the software version, server configuration and whether the relevant security fixes have been installed.
Administrators urged to install security updates
The alert calls on information technology teams to consult PHP’s official security guidance and update affected systems without delay.
The reported fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Administrators should check their installed versions and apply the appropriate updates.
Organisations running PHP 8.1 or older versions should also consider moving to a supported release, as these versions no longer receive regular support from the PHP project.
The warning highlights the importance of keeping website infrastructure updated. For businesses, public institutions and other organisations operating online platforms, prompt security updates can help reduce the risk of unauthorised access and protect sensitive information.