DPO and HKCERT warn of critical “PHP2Shell” vulnerabilities: SMEs with websites or embedded PHP should inventory assets and patch now
On 22 Oct 2026 the Digital Policy Office issued a Security Alert on critical PHP RCE flaws (CVE-2026-109618/109619, “PHP2Shell”). HKCERT rates Extremely High Risk with in-the-wild exploitation. Upgrade to 8.5.12/8.4.27/8.3.36/8.2.35 or isolate. Defensive guidance only.
On 22 October 2026, Hong Kong’s Digital Policy Office (DPO) said it attached great importance to critical security vulnerabilities in PHP, a web programming language widely used in backend operations of global websites. The DPO issued a Security Alert to all Government Bureaux and Departments and public organisations, asking them to review whether information systems were affected and to complete patching as soon as possible; otherwise, relevant systems should be temporarily taken offline or isolated to reduce the risk of malicious intrusion. The DPO also appealed to the public and organisations to apply patches immediately. Separately, the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) issued a Security Bulletin the same day, and GovCERT.HK published High Threat Security Alert A26-10-36. Industry coverage refers to the pair of flaws as “PHP2Shell”. This article summarises the official alerts for SMEs that run websites or embedded PHP. It is general information for defensive inventory and official upgrade paths only. It does not teach exploits or attack steps, and it is not a claim that every Hong Kong website has already been compromised.
Lifecycle status
Security alert / bulletin issued; active exploitation reported. HKCERT rates the issue Extremely High Risk and states that CVE-2026-109618 and CVE-2026-109619 are being exploited in the wild. GovCERT notes that proof-of-concept exploit codes have been reported and that exploitation is active. As of its 22 October 2026 release, the DPO said it had not received any reports of related cybersecurity incidents. Do not overstate this as “all Hong Kong websites already breached.” Treat it as an urgent patch-and-inventory signal.
What is affected (official summary)
- PHP versions prior to 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (including older / end-of-life branches that the PHP project no longer updates).
- Impact: remote code execution (RCE) on a targeted system if successfully exploited.
- Also check: commercial products and open-source stacks that embed PHP (HKCERT lists vendor advisories such as WordPress, F5, Citrix, Palo Alto Networks and QNAP among others). Ask your vendor whether your stack is affected and which fix applies.
What SMEs should do (defensive only)
- Inventory: list websites, intranet apps, CMS, plugins and appliances that run or embed PHP (including hosted or agency-managed sites).
- Patch: upgrade PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, or apply the vendor / distribution LTS backported fix your supplier documents.
- If you cannot patch immediately: HKCERT and GovCERT advise considering isolating internet-facing applications from public networks, or taking them offline, until fixes are applied and verified. Temporary mitigations on the PHP project site may reduce some exposure but are not a complete substitute for an update.
- Need help: HKCERT guidance via email [email protected], telephone 8105 6060, or the online form cited in the DPO release.
How this differs from other security pieces on this site
HKBSCL has covered voluntary programmes such as free website security scans and BugHunting registration windows. This piece is different: it reports a government / CERT emergency patch-and-inventory alert for critical PHP RCE flaws already under active exploitation—not a promotional scan campaign or DIY cyber-attack tutorial.
Sources: Government Press Releases — Digital Policy Office attaches great importance to latest cybersecurity vulnerability (Hong Kong, 22 October 2026); Chinese: 數字政策辦公室高度關注最新網絡安全漏洞; HKCERT — PHP Multiple Vulnerabilities; GovCERT.HK — High Threat Security Alert A26-10-36; PHP project security updates: php.net archive 2026-10-21-5. Accessed 2026-10-23 ~12:14 HKT (Asia/Hong_Kong).
This article is general information only and is not legal, tax, accounting, cybersecurity consulting, or IT operations advice. It does not provide exploit details, attack procedures, or DIY steps that replace qualified security professionals, hosting providers, or vendor guidance. Scope and risk depend on each organisation’s systems. No guarantee is given of outcomes, complete coverage of every product, or that temporary mitigations equal a full patch. Readers should follow official DPO / HKCERT / GovCERT / vendor notices and obtain professional help before changing production systems.