PHP2Shell explained: Why Filipinos should watch out for fake security alerts and scam links

Cybersecurity experts around the world are urging organizations to update their systems after the discovery of two critical security vulnerabilities in PHP.

File photo (actual photo of my personal laptop w/ screen edited using AI)

Disclosed on October 21, 2026, the flaws, identified as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed "PHP2Shell," could allow unauthenticated attackers to remotely execute malicious code on vulnerable servers.

The PHP development team has since released emergency security updates and urged website operators and developers to patch affected systems immediately.

According to the Cyber Security Agency of Singapore (CSA), both vulnerabilities received a severity rating of 9.2 out of 10. The agency also warned of reports involving active exploitation attempts and the availability of proof-of-concept code that could be used by attackers.

What is PHP2Shell?

Image source

Collectively known as "PHP2Shell," the vulnerabilities could allow hackers to remotely take control of vulnerable servers without needing to log in.

In case you missed it, PHP is one of the most widely used general-purpose scripting languages for building websites and online services. Because it powers countless websites and digital services worldwide, vulnerabilities affecting PHP could potentially impact a large number of organizations if left unpatched.

The disclosure triggered a global response from governments, businesses, and website operators. 

According to Reuters, organizations worldwide rushed to secure their systems after cybersecurity experts observed a surge in attack attempts shortly after the vulnerabilities became public.

Several government websites overseas were reportedly disrupted, prompting governments across Asia to issue advisories and conduct cybersecurity inspections.

In the Philippines, the National Computer Emergency Response Team (CERT-PH) also issued an advisory urging organizations to identify affected systems and apply the necessary security updates.

Note: The announcement does not automatically mean that consumer accounts have been compromised. However, it serves as a timely reminder for users to stay vigilant and practice good cybersecurity habits, especially as cybercriminals often exploit major security incidents to launch scams and phishing attacks.

Users of banking apps, e-wallets, and other digital financial services may become targets of phishing scams, fake security alerts, and fraudulent login pages.

Common online scams to watch out for

• Phishing campaigns - Phishing campaigns are organized attempts by cybercriminals to trick people into revealing sensitive information such as passwords, OTPs, bank details, or account credentials.
• Fake security-update messages - A fake security-update message is a scam message that pretends to be from a trusted company or service and falsely claims that you need to update your account, password, app, or device immediately.
• Fraudulent login pages - A fake login page is a fraudulent website that mimics a legitimate service to trick users into entering usernames, passwords, OTPs, PINs, and other sensitive information.
• Social engineering attacks - Social engineering attacks are scams that trick people into sharing passwords, OTPs, personal information, or money by pretending to be someone they trust. Examples include scammers impersonating banks or trusted organizations through fake customer support calls, security alerts, text messages requesting OTPs, and fraudulent login pages designed to steal sensitive information.

Governments and cybersecurity agencies are paying attention, and ordinary users care

While the PHP2Shell vulnerabilities primarily affect website operators rather than individual users, major cybersecurity incidents often create opportunities for scammers to exploit public concern.

Cybercriminals may send fake security alerts, scam messages, fraudulent links, or direct users to fake login pages in an attempt to steal passwords, OTPs, financial information, and other sensitive data.

As a result, consumers should remain vigilant and follow good cybersecurity practices, such as verifying messages, avoiding clicking suspicious links, and enabling multifactor authentication (MFA).

Warning signs of fake security alerts

• Urgent "update now" messages
• Suspicious links, especially from SMS
• Requests for passwords
• Requests for OTPs
• Messages from unknown senders
• Poor grammar or strange URLs

Basically, common warning signs of a scam include urgent messages demanding immediate action, suspicious links, requests for passwords or OTPs, messages from unknown senders, and websites with poor grammar or unusual web addresses.

If you encounter any of these red flags, avoid clicking links or sharing personal information until you have verified the message through the organization's official website, app, or customer support channel.

So, how to protect your accounts?

• Use strong, unique passwords
• Enable multifactor authentication
• Never share OTPs or PINs
• Verify links before clicking
• Access services through official apps and websites
• Monitor account activity regularly
• Keep devices updated

In the Philippines, where online banking, e-wallets, shopping platforms, and social media are part of everyday life, practicing good cybersecurity habits is essential. Filipinos can better protect themselves by using strong passwords, enabling multifactor authentication, and never sharing OTPs, PINs, or verification codes.

Verifying websites, using official apps, regularly checking account activity, and keeping devices updated can help reduce the risk of scams, unauthorized access, and other cyber threats.

What to do if you think you've been hacked?

• Change passwords immediately
• Enable multi-factor authentication or MFA
• Contact the affected service
• Monitor financial accounts
• Report to authorities or official support channels

We also asked veteran technology journalist, ScamWatch co-founder, cybersecurity analyst,  Mr. Art Samaniego, the Assistant Vice President (AVP) at the Information and Communications Technology Department of the Manila Bulletin, about his expert insights on the matter.

How serious are the PHP2Shell vulnerabilities?

They are serious. PHP powers many websites, and these flaws affect PHP itself, not just WordPress or another website platform. Both vulnerabilities are rated 9.2 out of 10 (Critical) and could allow an attacker to send a request without logging in and run code on a vulnerable server. Depending on the server’s permissions, that could expose website data or credentials, disrupt services, or give an attacker a foothold inside an organization. The PHP project has released fixes, and updating the PHP runtime is the complete solution.

Have PHP2Shell-related attacks been reported in the Philippines?

As of October 30, I have not found a publicly verified Philippine incident specifically attributed to CVE-2026-109618 or CVE-2026-109619. Globally, security agencies have reported exploitation attempts, and the [U.S. Cybersecurity and Infrastructure Security Agency] CISA has listed both vulnerabilities in its Known Exploited Vulnerabilities catalog. That shows why organizations need to act, but it does not confirm that a Philippine organization has been compromised.

What risks do these flaws pose to Filipino internet users?

The direct risk is to vulnerable servers. If a website is compromised, the information it holds or can access could be exposed or altered. Visitors’ devices aren't automatically infected just because they visit a vulnerable site, but a compromised website can still create additional risks. People should also watch for phishing messages that use the PHP2Shell news to trick them into clicking links or sharing personal information.

What practical steps can Filipinos take to protect their accounts and personal information?

Use a different, strong password for every important account, preferably stored in a password manager, and turn on multi-factor authentication or passkeys where available. Keep phones, computers, browsers, and apps updated. Never share an OTP, PIN, or password, and verify unexpected messages by opening the official app or typing the organization’s website address yourself. Check account activity and transaction alerts regularly.

Website owners and organizations have a separate responsibility. They need to ask their hosting provider or IT team to confirm that the PHP runtime is patched and that the PHP processes have been restarted. Updating a website’s content management system or plugins alone does not fix a PHP runtime flaw.

What should someone do if they think they have been hacked or scammed?

Contact the bank or e-wallet provider immediately through its official hotline or app and ask it to secure the account, block affected cards or transactions, and guide you through recovery. From a trusted device, secure your email accounts first, change reused or compromised passwords, sign out of unknown sessions and devices, and enable multi-factor authentication. Save screenshots, messages, phone numbers, links, and transaction details as evidence. Report the incident to the CICC through Hotline 1326 and, when appropriate, to the PNP Anti-Cybercrime Group or the NBI. The BSP also advises scam victims to report the incident to their financial institution and law enforcement.

Sir Art also created an FAQ that we can check at this link. 

Our thoughts

Cyber threats keep evolving, but awareness remains one of the strongest defenses.

This development serves as a reminder for Filipinos to stay vigilant against scams, fake security alerts, and phishing attempts that often emerge after major cybersecurity incidents.

If you believe your account has been compromised, change your password immediately, enable multifactor authentication, contact the affected service provider, and report the incident through official support channels or the appropriate authorities.

The sooner a potential compromise is reported, the better the chances of preventing further unauthorized access or financial losses.

Staying informed and relying on official advisories can go a long way in protecting your personal information and online accounts.