Millions of Hacking Attempts Target PHP Flaws: What Businesses Must Do to Protect Their Websites

A website can look perfectly normal to visitors while running software that attackers are actively trying to exploit.

That is the concern behind the latest PHP security incident, which has prompted urgent action from businesses, government agencies and technology providers around the world. On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities that could allow unauthenticated attackers to execute malicious code on affected systems. Soon afterwards, Cloudflare reported millions of attempts to exploit the vulnerabilities.

For businesses that depend on websites, online stores, customer portals and web applications, this incident highlights a fundamental cybersecurity challenge: identifying a vulnerability is only the beginning. Organisations must also identify affected systems, apply the correct fixes, verify that the systems are secure and investigate whether an attack has already occurred.

The growing use of artificial intelligence in cybersecurity adds another dimension. AI can help security researchers identify weaknesses, but attackers can also use increasingly capable tools to discover and exploit vulnerable systems more quickly.

In this article, we explain what happened with the latest PHP vulnerabilities, why AI-assisted hacking is attracting attention, and what Malaysian businesses can do to protect their websites and IT infrastructure.

What Happened in the Latest PHP Security Incident?

PHP is a server-side programming language widely used to build dynamic websites and web applications. It powers content management systems, online stores, business portals and many other internet-facing services.

On 21 October 2026, the PHP project released security updates for four supported release branches to address two critical vulnerabilities. The issues were identified as CVE-2026-109618 and CVE-2026-109619 and were reported as potentially enabling remote code execution without authentication.

Remote code execution is a serious security risk because it can allow an attacker to run malicious instructions on a vulnerable server. Depending on the environment and the permissions available to the compromised process, this could lead to further unauthorised access, data exposure or disruption.

Cloudflare subsequently reported a rapid increase in exploitation attempts after the vulnerabilities became public. Reuters reported that companies and governments were rushing to patch affected systems, with some organisations temporarily suspending online services as a precaution.

An important distinction: millions of reported exploitation attempts do not mean millions of websites were successfully hacked. Attack attempts, successful exploitation and confirmed data breaches are different things. Each organisation must assess its own exposure and investigate any evidence of compromise.

Which PHP Versions Received Security Updates?

The PHP development team published the following fixed versions on 21 October 2026.

These versions address the two critical vulnerabilities identified in the advisory. Administrators should consult the official PHP security information and their hosting provider’s guidance to confirm the appropriate update for their environment.

The displayed version number may differ when a hosting provider or operating system vendor maintains its own package and backports security fixes. Therefore, do not rely on the version number alone without checking the vendor’s advisory.

PHP 8.2 is also approaching the end of its upstream support period, scheduled for 31 December 2026. Businesses still using it should plan their next upgrade rather than treating the latest security patch as a long-term maintenance strategy.

For the latest information, consult the official PHP security announcements.

Why Are These PHP Vulnerabilities Serious?

The main concern is not simply that PHP is widely used. It is that the affected software operates on servers that process website requests and execute application code.

When a critical vulnerability affects an internet-facing component, an attacker may be able to target the underlying runtime rather than exploit an individual website feature. The potential impact depends on the PHP execution model, server configuration, application behaviour and permissions available to the affected process.

Possible consequences of a successful compromise can include:

• Unauthorised execution of code on the affected server.
• Exposure of sensitive information accessible to the compromised process.
• Unauthorised changes to website files or application behaviour.
• Further attempts to access databases, credentials or connected systems.
• Service interruption, malware installation or additional compromise.

These are potential consequences, not proof that every vulnerable server will experience them.

A website may continue to load normally even when its underlying software needs urgent attention. A working homepage is not evidence that a server is patched or that no unauthorised activity has occurred.

This is why businesses need a process for checking server-side software, maintaining systems and investigating suspicious activity.

How Is AI Changing the Cybersecurity Landscape?

Artificial intelligence is becoming a useful tool for both defensive security work and offensive activity.

Security researchers can use AI-assisted techniques to examine code, identify unusual patterns, investigate potential weaknesses and help prioritise vulnerabilities. This can improve the speed at which security problems are discovered.

However, attackers can use similar capabilities to analyse exposed software, automate parts of reconnaissance and adapt their approaches to vulnerable targets.

The result is a race between discovering a weakness, developing a reliable fix, applying that fix and preventing exploitation.

1. Faster vulnerability discovery

AI tools can help researchers examine large codebases and identify suspicious logic or memory-handling problems. Human expertise is still important to validate findings, determine exploitability and develop appropriate fixes.

2. More efficient attack preparation

Attackers may use automation to identify exposed services, compare software versions and prioritise systems that appear vulnerable. This can increase the number of targets examined in a short period.

3. Less time to respond

Once technical details become public, attackers may analyse available patches and develop methods to target systems that remain unpatched. Organisations should therefore treat critical security announcements as operational priorities rather than routine maintenance notices.

4. Greater need for continuous maintenance

Security cannot depend entirely on occasional manual checks. Businesses need reliable asset inventories, update procedures, access controls, backups and a clear way to respond when new vulnerabilities are announced.

AI does not make every vulnerability easy to exploit, and it does not mean every AI-assisted attack will succeed. The practical lesson is that organisations should reduce the time between learning about a relevant security issue and taking effective action.

Are WordPress Websites Also at Risk?

WordPress is built primarily on PHP, so the PHP runtime used by a WordPress installation matters. However, this incident is not a WordPress-only vulnerability.

The PHP security issues affect the underlying runtime used by many PHP applications. A site may therefore require action at the server or hosting level even when its WordPress core, theme and plugins are up to date.

The official WordPress announcement explains that the PHP vulnerabilities are not specific to WordPress and that a WordPress core release is not required to fix the underlying PHP issues.

Read the WordPress security announcement.

If your business website runs WordPress, take these steps:

1. Check the PHP version. In WordPress, open Tools → Site Health → Info → Server. Your hosting control panel may also display the active PHP version.
2. Contact your hosting provider. Ask whether the affected PHP runtime has been patched and whether any provider-specific action is required.
3. Confirm the fix is active. Do not assume that a WordPress plugin update or a routine site backup automatically patches PHP.
4. Update WordPress components. Keep WordPress core, themes and plugins current as part of your broader security maintenance.
5. Review administrative access. Remove unnecessary accounts and ensure privileged users have strong, unique credentials and appropriate authentication controls.
6. Check backups and recovery procedures. Confirm that you have a usable backup and understand how to restore your site safely.
7. Investigate suspicious activity. If you suspect compromise, review available logs and security alerts, preserve relevant evidence and seek appropriate technical assistance.

Businesses that cannot immediately remediate an exposed system should follow their hosting provider’s and security advisories’ instructions. Depending on the circumstances, isolating or temporarily taking an affected service offline may be safer than continuing to expose a vulnerable system.

What Should Malaysian Businesses Do Right Now?

For Malaysian businesses, the immediate priority is to determine whether any internet-facing systems are affected and make sure the appropriate fixes are in place.

A practical response can be organised into five steps.

Step 1: Identify all PHP-based systems

Do not check only the main corporate website. Include online stores, customer portals, internal applications exposed to the internet, staging environments and other websites managed by your organisation.

Create an inventory of the domains, hosting accounts, server environments and applications involved. If different providers manage different systems, assign responsibility for checking each one.

Step 2: Prioritise exposed and business-critical systems

Start with public-facing systems that process important business information or support essential operations.

Examples include:

• E-commerce websites and customer checkout systems.
• Customer login portals and account dashboards.
• Websites that collect enquiries or personal information.
• Business applications connected to databases.
• Public-facing services hosted on PHP-enabled servers.

Prioritisation should reflect exposure, business impact and the vendor’s security guidance.

Step 3: Apply the appropriate security fix

Work with your hosting provider or system administrator to update the affected PHP installation to a fixed version or apply the relevant vendor-maintained security package.

Where an upgrade could affect application compatibility, test it in an appropriate environment and coordinate deployment carefully. Compatibility concerns should be managed promptly; they should not become an indefinite reason to leave a critical vulnerability unaddressed.

Step 4: Check for signs of compromise

Installing a patch helps address a vulnerability, but it does not automatically remove malicious code or reverse an earlier intrusion.

Where exposure or suspicious activity is identified, examine available server logs, authentication events, file changes and security alerts. Consider whether credentials, API keys or other secrets may need to be rotated.

If a compromise is suspected, avoid simply deleting suspicious files without preserving the evidence needed to understand what happened.

Step 5: Establish a repeatable security process

A single emergency update is not a substitute for ongoing maintenance. Establish clear responsibilities for monitoring security advisories, maintaining software, reviewing access, testing backups and responding to incidents.

For organisations without sufficient internal IT resources, external technical support can help coordinate these activities and reduce the chance that critical updates are overlooked.

Businesses looking to strengthen their wider protection can explore Plenitude IT’s cybersecurity services in Malaysia.

Why Website Security Must Go Beyond Software Updates

Applying security patches is essential, but a secure website requires more than keeping its PHP version current.

Websites depend on several connected components: the hosting environment, web server, application code, CMS, plugins, database, administrator accounts and external integrations. A weakness in one area can undermine controls in another.

A comprehensive website security programme should address the following areas.

Secure website configuration

Review administrative access, file permissions, exposed services, security settings and unnecessary components. Limit privileges to what users and applications genuinely need.

For WordPress sites, this also includes reviewing installed themes and plugins, removing unused components and keeping maintained software up to date.

Web application protection

Review the application for known vulnerabilities and insecure configurations. Where appropriate, consider a web application firewall and other protective controls.

These measures can help reduce exposure, but they should not be treated as substitutes for applying vendor security fixes.

Reliable backups and recovery

Maintain backups appropriate to the business’s recovery needs, protect them from unauthorised modification and test restoration procedures. A backup that cannot be restored reliably may not provide the protection the business expects.

Monitoring and incident response

Ensure that suspicious events can be identified and investigated. Establish a response process that covers containment, investigation, recovery and any necessary communication.

For businesses that need a more comprehensive approach, Plenitude IT’s website design and development services can be considered alongside appropriate security planning and maintenance.

The Role of IT, Network and Cloud Security

A vulnerable website may be only one part of a wider technology environment. Depending on the configuration, a compromised application can create additional risks for connected systems and data.

Businesses should therefore review their security at several levels.

IT infrastructure security: Keep operating systems, server software and business applications maintained. Review administrative permissions and remove unnecessary access.

Network security: Review firewall rules, remote access, network exposure and connectivity between systems. Appropriate segmentation can help limit the impact of a compromised device or application.

Explore Plenitude IT’s network solutions for related infrastructure needs.

Cloud security: Review account permissions, exposed services, configuration settings and the protection of data stored in cloud environments.

Explore Plenitude IT’s cloud solutions for related cloud technology requirements.

Managed IT support: Establish responsibilities for updates, maintenance, monitoring and technical response. Businesses should confirm the precise scope of any support agreement, including whether security monitoring or incident response is included.

Explore Plenitude IT’s managed IT services to learn about related IT support options.

Custom software security: Organisations using bespoke business applications should also review application maintenance, dependencies, authentication and deployment practices. Security requirements should be considered throughout the software lifecycle, not only after a vulnerability becomes public.

Explore Plenitude IT’s custom software development services for related development needs.

These measures are complementary. No single product or service can eliminate every cybersecurity risk, and the right combination depends on the systems a business operates.

Can a Website Be Hacked Even If It Has an SSL Certificate?

Yes. An SSL/TLS certificate helps encrypt data exchanged between a user’s browser and a website. It does not prove that the website’s server software is patched, its code is secure or its administrator accounts are protected.

A website can have a valid HTTPS connection while running outdated software or containing a serious vulnerability.

Businesses should treat encryption as one component of a wider security strategy that includes software maintenance, access control, secure configuration, backups and monitoring.

What If Your Website Has Already Been Compromised?

If you suspect that your website or server has been compromised, focus first on containment and investigation.

The appropriate response depends on the affected system, the evidence available and the potential impact on business operations.

A typical response may include:

1. Assessing the affected websites, servers and accounts.
2. Restricting access or isolating systems where necessary.
3. Preserving relevant logs and other evidence.
4. Applying security fixes and correcting the vulnerabilities involved.
5. Investigating suspicious files, processes, accounts and access events.
6. Rotating potentially exposed credentials and secrets.
7. Restoring clean systems or files where required.
8. Monitoring the environment for further suspicious activity.

Avoid assuming that the problem is resolved simply because the homepage loads again. A proper recovery process should establish, as far as reasonably possible, what was affected and what corrective measures are required.

Businesses needing technical assistance can contact Plenitude IT to discuss their website and IT security requirements. The appropriate scope of investigation, cleanup and recovery should be confirmed for each incident.

A Practical Cybersecurity Checklist for Business Owners

Use this checklist to start a conversation with your internal IT team or hosting provider.

• Identify websites and applications that use PHP.
• Confirm whether the hosting provider has applied the relevant security fixes.
• Verify the active PHP runtime or vendor-maintained security package.
• Prioritise internet-facing and business-critical systems.
• Keep CMS platforms, themes, plugins and other supported software maintained.
• Review administrator accounts, permissions and authentication controls.
• Confirm that backups are protected and restoration has been tested.
• Review logs and alerts if a system may have been exposed.
• Establish a clear process for emergency security updates.
• Review wider IT, network and cloud security controls.
• Document responsibilities for maintenance, investigation and recovery.

Completing this checklist does not constitute a full security audit, but it provides a useful starting point for identifying gaps and prioritising action.

Conclusion: Security Updates Cannot Wait Until the Next Maintenance Cycle

The latest PHP security incident demonstrates how quickly a software vulnerability can become an operational concern when technical details become public and attackers begin targeting affected systems.

AI-assisted vulnerability discovery is an important development, but the practical response remains grounded in established security fundamentals: know what systems you operate, apply appropriate fixes, limit unnecessary access, protect backups and investigate suspicious activity.

For Malaysian businesses, the most useful next step is to confirm the status of their PHP-based websites and applications, coordinate any necessary updates with their hosting providers and establish a repeatable process for managing future vulnerabilities.

Website security, IT infrastructure protection, network controls and cloud security should work together as part of a broader risk-management approach.

Need help reviewing your website or IT security priorities? Contact Plenitude IT to discuss your requirements and determine an appropriate scope of support.

Frequently Asked Questions