NÚKIB urges PHP sites to update after critical php2shell flaws

Situation Overview

On 21 October 2026, the Czech National Cyber and Information Security Agency (NÚKIB) recommended that operators of websites and other services using PHP apply updates immediately after two critical vulnerabilities were identified as enabling remote code execution without prior login. NÚKIB said the vulnerabilities, referred to as “php2shell”, have published fixes and publicly available information that could be used to exploit them. It cited patched PHP versions including 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The Czech government’s office temporarily took its website offline as a precaution. Developers of the PHP language released versions to address the critical vulnerabilities, Reuters reported on 21 October. The immediate focus is on whether operators across affected services deploy the patched PHP versions to reduce exposure to remote exploitation.

Geopolitical Implications

1. 01

   The advisory shows how quickly vulnerabilities in widely used software can drive cross-border cyber risk and force government operational responses.

2. 02

   A temporary shutdown of a government website signals heightened concern about exploitation and the need for rapid patching in public-sector digital services.

Key Signals

• —

  Adoption of the cited patched PHP versions by Czech and broader PHP-hosting operators

• —

  Any further NÚKIB updates on exploitation attempts or additional affected PHP versions

Topics & Keywords

Market Impact Analysis

AI Threat Assessment

Event Timeline