High alert issued over cyberattack threat in BD

Bangladesh's government Computer Incident Response Team, BGD e-GOV CIRT, has issued a high alert over two critical security vulnerabilities identified in PHP, a widely used programming language. The vulnerabilities have been collectively dubbed “PHP2Shell”.

The agency said, the vulnerabilities carry the CVE identifiers CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2, indicating a critical level of risk. Exploiting the flaws could allow hackers to execute malicious code remotely on servers without requiring a username or password.

According to CIRT, the vulnerabilities stem from PHP's memory management. Under certain conditions, data from previous requests may remain accessible after memory exhaustion or release. Attackers could exploit this weakness by sending specially crafted HTTP requests to gain control of affected servers.

Users of PHP-FPM and Apache's mod_php are among those most at risk. Other potentially affected environments include PHP-CGI, FrankenPHP, LiteSpeed, Docker containers and shared hosting services. Government portals, banks, e-commerce platforms, and websites built with WordPress and Laravel may also be vulnerable.

The alert warned that a successful attack could result in attackers taking control of an entire server, stealing data and files, exposing database passwords and API keys, and disrupting websites.

As a solution, CIRT has urged users to update PHP immediately. The secure versions listed in the advisory are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It also advised administrators to ensure that the server's core PHP runtime-not just the application framework-has been updated.

For organisations unable to install the patches immediately, the advisory recommends temporarily placing servers behind a VPN, implementing IP-based access controls and increasing log monitoring.

However, CIRT stressed that updating PHP is the only permanent solution to the vulnerabilities. 

-MT