Receipts attached 8 sources
Sources
-
Other source
DPO urges PHP checks and says homepage service patched
Public-sector alert, patching statement and incident-report status
-
Other source
High Threat Security Alert A26-10-36
Affected versions, exploitation reports and vendor advice
-
Other source
HKCERT warns of PHP2Shell vulnerabilities
Embedded PHP and inventory guidance
-
Other source
Security advisory: Critical remote code execution vulnerabilities
Fixed versions, risk scope and mitigation limits
-
Other source
PHP2Shell patches land as exploitation attempts hit sensors
Disclosure leak date
-
Other source
Websites hit by millions of PHP exploit attempts
Cloudflare attempts and UK precautionary shutdowns
-
Other source
PHP releases emergency fixes
Dated researcher observations on attempted versus confirmed exploitation
-
Other source
Why it is urgent to update PHP on WordPress sites
WordPress updates do not update server PHP
Limits
The DPO confirmed patching of its shared homepage-hosting service and said it had received no related incident reports as of 10:44 p.m. October 22. It supplied no count of other affected or patched public systems. Global exploitation-attempt figures do not establish successful intrusion in Hong Kong. CyberScoop’s account of researchers’ observations was current to Wednesday afternoon.
Corrections
No correction notes have been added for this article.
The Digital Policy Office says it has received no reports of related incidents. It has not said how many other public systems run vulnerable PHP, or when the checks will finish.
Hong Kong’s Digital Policy Office (DPO) has asked every government bureau, department and public organisation to review their systems for two critical PHP flaws. The office said on Thursday night that it had issued a security alert requesting an immediate, comprehensive review, with patching completed as soon as possible. Systems that cannot be patched should be taken offline or isolated. It also said it had completed the required patching for the web content hosting service that hosts the homepages of all bureaux and departments.
The statement, issued at 10:44 p.m., added that the office had not received any reports of related cybersecurity incidents. That describes what the DPO has been told so far. It is not a finding that no system was exposed or breached, and the office did not say every public system is clear.
The homepages are not the whole picture
The flaws affect PHP itself, so the exposure is wider than the visible websites. HKCERT, Hong Kong’s computer emergency response team, says the risks extend beyond conventional web servers: business applications, networking and security appliances, storage systems and monitoring systems may have PHP embedded in their administration interfaces or operational components. It urges organisations to identify affected externally accessible systems, prioritise patching internet-accessible services and check for signs of compromise.
GovCERT.HK, the government’s own response team, adds that commercial products and open-source software may also be affected, and recommends asking product vendors whether patches are available. A review of the main web servers could miss all of that.
What the flaws are
The flaws are known as PHP2Shell and are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security team rates both 9.2 on the CVSS v4.0 scale. Details leaked online on October 20, ahead of the planned disclosure. PHP released fixes the next day.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says all installations serving web requests are at risk, with the highest risk for Apache’s mod_php. On a vulnerable installation, a remote attacker may be able to run code on the server without logging in. That is a risk to the machine running a site. It is not evidence that every PHP website has been compromised.
Older installations are harder to fix. PHP 8.1 and earlier no longer receive updates from the PHP project, though some distributions and long-term-support vendors provide backported fixes. The team also supplied minimal source backports for PHP 7.4, 8.0 and 8.1. Only an update is a complete solution. Temporary measures reduce exposure to specific attack paths but do not make an installation safe.
For ordinary site owners, the fix is not automatic. Wordfence, which makes WordPress security software, warned that WordPress’s automatic updates will not apply the PHP fix, and advised owners to find out who is responsible for updating PHP on their sites.
Attempts, shutdowns and confirmed breaches
GovCERT.HK’s alert says reports indicate proof-of-concept exploit code is available and the flaws are being actively exploited in the wild. Cloudflare chief executive Matthew Prince reported millions of exploitation attempts within hours of the disclosure. In the UK, 32 government services were taken offline. The cybersecurity minister said this largely resulted from precautionary measures, and Downing Street said it did not mean the services had been hacked.
Researchers were more cautious about what the attempts had achieved as of Wednesday afternoon. CyberScoop reported that multiple researchers had seen little activity beyond reconnaissance, and a Huntress analyst said the firm had not observed or independently confirmed successful in-the-wild exploitation on live customer systems. Attempted attacks and precautionary shutdowns are not confirmed intrusions, and none of these figures count Hong Kong incidents.
What is still unknown
The DPO’s statement establishes two things: its shared homepage-hosting service is patched, and a check-and-patch alert has gone to the wider public sector. It does not say how many other public systems run affected PHP versions, how many are patched, or when the reviews will report. It also offered no figure for public bodies that have taken systems offline.
The office also appealed to the public and organisations to apply patches to all affected systems. HKCERT can be reached at hkcert@hkcert.org or 8105 6060. The next useful update is the result of the public-sector reviews and whether any local compromise is confirmed.