ICT

Home page

ICT

Azerbaijan's Cybersecurity Agency warns millions of websites are at risk

22 October 2026 12:21 (UTC +04:00)

The National Cybersecurity Agency (NCA) under the Ministry of Digital Development and Transport has warned about two critical security vulnerabilities discovered in the PHP programming language, dubbed "PHP2Shell," the Agency told APA-Economics.

PHP is one of the most widely used programming languages that enables websites and web applications to function. A large proportion of websites on the internet operate using this language. These include popular content management systems (CMS) such as WordPress, Joomla, and Drupal, online stores, e-learning platforms, and hosting management panels. Therefore, the discovered vulnerabilities are not limited to a single resource and simultaneously pose risks to all information systems using this language.

The discovered vulnerabilities (CVE-2026-109618, CVE-2026-109619) have been rated 9.2 (critical) on a 10-point scale. The vulnerabilities allow an attacker to remotely execute arbitrary commands on a server by sending a specially crafted request. No username, password, or other security vulnerability on the website itself is required to carry out the process. This makes it possible to conduct attacks easily and on a large scale.

An attacker who successfully exploits the vulnerabilities can take control of the server and install a malicious file that provides permanent remote access to it. As a result, login credentials for databases and other services, as well as users' personal data, may be stolen. Website content may also be altered, malicious software, including ransomware, may be distributed, and the compromised server may be used to infiltrate an organization's internal network and attack other systems.

In this regard, the NCA urges website owners, hosting providers, and organizations managing information systems to implement the following measures without delay:

Update PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Website owners whose websites are hosted on hosting providers' servers and who do not have direct access to the servers should contact their providers to take the necessary measures to eliminate the security vulnerabilities.
Check whether suspicious operations have been carried out on the server.
If server compromise is suspected, isolate the system from the network and preserve logs.

Additionally, it is recommended to immediately report cyber incidents to the National CERT, apply software security updates in a timely manner, regularly check the security status of information systems, and strengthen monitoring.

According to international statistics, approximately 70% of the world's most visited websites whose server technologies can be identified operate using this language. The WordPress platform, used by nearly 40% of these websites, is also built on PHP. In other words, approximately two-thirds of the most visited websites are potentially affected by these vulnerabilities and are therefore at risk.