Global Internet at Risk of Collapse as Komdigi Issues Warning

Jakarta, CNBC Indonesia — The Ministry of Communication and Digital Affairs (Komdigi) has issued a warning about PHP2Shell, two critical security vulnerabilities that could allow hackers to execute code remotely on affected systems without logging in.

The warning was issued by Komdigi’s Computer Security Incident Response Team (CSIRT) on 22 October 2026.

The vulnerabilities are registered as CVE-2026-109618 and CVE-2026-109619. Each received a score of 9.2 on the CVSS v4.0 scale, indicating a very high level of severity.

PHP’s developers had initially scheduled disclosure of the vulnerabilities for 22 October 2026. However, after information about the flaws leaked ahead of schedule, security updates were released early, on 21 October 2026.

The vulnerabilities were discovered by researchers from Wiz, Calif and OpenAI. They are estimated to affect almost all PHP versions dating back to version 5.4, prompting server administrators to check the systems they manage as soon as possible.

The greatest risk has been identified on servers using Apache mod_php. In a scenario demonstrated by researchers, an attacker needs to send only one unauthenticated HTTP request to trigger an attack before application code runs.

This means security measures implemented only at application level may not be enough to stop an attack, since exploitation can occur before the application has a chance to process the request.

PHP2Shell is therefore a serious concern for website operators, hosting providers, application developers and organisations that rely on PHP to run digital services.

PHP is used to build many kinds of web services. Because the vulnerabilities lie in the programming language’s core engine, their impact is not limited to any one platform or application.

PHP is reported to have released emergency security updates to address the two critical flaws. PHP2Shell has drawn particular concern because it affects the core PHP engine, leaving websites at significant risk even when the applications running on them have robust security systems.

The updates are available in PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. The PHP development team has stressed that upgrading to a patched version is the only way to close the vulnerabilities fully.

The threat has become more urgent after security researchers reported active attempts to exploit both flaws. Cloudflare has also confirmed that it detected a surge in attack traffic attempting to exploit the vulnerabilities against its customers.

Servers at risk

According to PHP’s official security advisory, all PHP installations handling web requests could be affected. These include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

Even a simple page displaying only “Hello World” could be targeted if it runs on a vulnerable PHP version. In other words, the complexity of an application is not the main factor in determining whether a server is affected, although the level of risk and route of exploitation may vary according to server configuration.

As well as enabling malicious code execution, the vulnerabilities also create a risk of information being exposed from PHP process memory.

That memory may contain sensitive data, including passwords, authentication tokens, API keys and certificates associated with other requests. If an attacker can read this information, the impact could extend to the security of accounts, applications and other services that use those credentials.

Researchers have even demonstrated reading the memory of a running PHP process on an application they did not control. This finding shows that the risk does not depend solely on the application code running on PHP.

Following the disclosure, the PHP Foundation said it had changed its security decision-making process and added personnel and supporting tools to help identify similar problems more quickly in future.

Komdigi advises server administrators and website operators to ensure their PHP versions are up to date, restart the relevant processes and check server logs for signs of suspicious activity.

“Exploitation attempts have been reported, so relying on a firewall or configuration changes is not enough to replace security updates,” Komdigi’s CSIRT team wrote.