eco Association on PHP2Shell: A Wake-Up Call for the Software Supply Chain in the AI Era

Critical vulnerabilities in the PHP core are disrupting websites: eco Association outlines immediate measures for operators and calls for greater transparency in the software supply chain.

Two critical vulnerabilities in the PHP programming language (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) prompted public authorities, hospitals, universities and companies worldwide to take websites offline as a precaution yesterday. The vulnerabilities allow attackers to execute malicious code on web servers without authentication (remote code execution). Security updates have been available since yesterday, but many systems are likely to remain unpatched. PHP is used by around 70 per cent of all websites with a known server-side programming language, as well as in routers, storage systems and security products - often without operators being aware of it. The vulnerabilities were discovered with the help of AI. From eco Association's perspective, the incident highlights the vulnerability of software supply chains and how rapidly the threat landscape is intensifying in the AI era.

Norbert Pohlmann, Board Member for IT Security at eco - Association of the Internet Industry:

"PHP2Shell is more than just another patch day. When a component that underpins a large proportion of all websites contains a critical vulnerability, part of our digital infrastructure is at risk. Today, AI not only helps defenders identify vulnerabilities; it also enables attackers to turn updates into working exploits in a very short time. The window between the release of a patch and the first attack is shrinking. Manufacturers, hosting providers and operators therefore need robust vulnerability management processes and coordinated disclosure procedures designed to keep pace with this acceleration. Furthermore, open-source software such as PHP forms the foundation of the Internet. Those who benefit commercially from it should regard its security as part of their own resilience and provide sustainable support. Critical software needs sufficient developers and reliable resources for maintenance and security testing - not just isolated projects."

Olaf Pursche, Head of the Security Competence Group at eco Association:

"What matters for operators now is to apply patches - across all affected systems - and verify that they are actually effective. Many companies are unaware of where PHP is running in the background, for example in the administration interfaces of routers, storage systems or security products. Outsourcing IT does not mean outsourcing responsibility. Companies must establish clear, binding agreements with hosting providers and IT service providers on who is responsible for applying updates and confirming their implementation. This incident also demonstrates why traditional prevention alone is no longer sufficient. As AI accelerates attacks, cyber resilience becomes essential: detecting attacks early, limiting their impact and restoring operations quickly. This also means checking whether systems have already been compromised, even after patches have been applied."

What Operators Should Do Now

• Identify affected systems: Determine where PHP is used, including in containers, outsourced applications and products with embedded PHP. Prioritise systems accessible from the Internet.
• Apply security updates: Install the patched versions (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or backported patches provided by distributions or hosting providers where applicable) and verify that the running services are actually using them. Updating a content management system (CMS) or its plugins alone is not sufficient.
• Replace outdated versions: For PHP 8.1 and earlier, apply a verified patch from the vendor or upgrade to a supported version.
• Mitigate risks: Following a risk assessment, isolate systems that cannot be secured promptly or temporarily take them offline. A Web Application Firewall (WAF) is not a substitute for patching.
• Check for compromise: Examine logs for suspicious activity and initiate incident response procedures if a compromise is suspected.
• Involve service providers: Ask hosting providers and IT service providers about their patch status and obtain confirmation that the necessary updates have been implemented.

eco Association's Recommendations and Calls for Action

• Respond more quickly: Establish clearly defined processes for prioritising and remediating critical vulnerabilities. Regularly test patch management, recovery and incident response procedures. Coordinated Vulnerability Disclosure (CVD) processes must account for the increasing speed of AI-assisted exploit development.
• Improve software transparency: Identify and document software components and dependencies using a Software Bill of Materials (SBOM).
• Clarify responsibilities across the IT supply chain: Establish binding agreements with hosting providers and IT service providers that clearly define responsibilities.
• Strengthen open-source security: Organisations that benefit commercially from open-source software should integrate the security of critical components into their procurement and risk management processes and provide sustainable support.
• Ensure consistent regulation of the software supply chain: The Cyber Resilience Act (CRA) will require manufacturers to adopt security by design and address vulnerabilities throughout the entire product lifecycle.