Security Alert: EPItech Ghana CEO Ivan Apaflo, Warns of the Critical PHP Flaw Threatening Millions of Websites and Shares Urgent Fixes
The Chief Executive Officer of EPItech Ghana, Ivan T. Apaflo, has issued an urgent advisory to businesses, schools, and organizations running websites on PHP following the discovery of two critical vulnerabilities that could allow attackers to take full control of websites.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, were announced in an emergency security release by the PHP Group on October 21, 2026. Both are rated 9.2 out of 10 (Critical) on the CVSS scale and allow for unauthenticated Remote Code Execution (RCE). 9d88
According to the PHP security advisory, the flaws reside in the core PHP runtime engine itself, not in any plugin or website theme, meaning even a perfectly coded website can be compromised if the underlying PHP version is not updated. 9d88
Speaking on the incident, Mr. Apaflo explained that the vulnerability stems from how PHP handles memory when a request fails halfway.
"What happened is that PHP doesn't clean up properly when a request runs out of memory. Attackers are sending specially crafted requests that deliberately cause that failure, and they use the mess left behind to execute their own code on the server," he said.
He noted that every PHP version from the past decade, back to PHP 5.4, is affected by at least one of the flaws, and CISA has already added it to its Known Exploited Vulnerabilities catalogue after spotting attacks in the wild. d2fb
How to Stay Safe: Solutions Proposed by EPItech Ghana
Mr. Apaflo outlined three immediate actions for website owners:
1. Update PHP Immediately: This is the only complete fix. Businesses should upgrade to the patched versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Older versions like 8.1 and 8.0 are end-of-life and will not receive official fixes. 9d88
2. Don't Rely on Workarounds: He cautioned that viral workarounds circulating online, such as disabling session.upload_progress, will not protect against PHP2Shell.
3. Take Sites Offline if You Can't Patch Immediately: If you cannot update right away, temporarily take vulnerable sites offline or put them behind a Web Application Firewall (WAF) while you prepare the patch, to prevent attackers from exploiting the flaw.
"While you're busy running your business, your website should be helping you, not exposing you. Updating your PHP version is not optional, it's critical business protection," Mr. Ivan Apaflo added.
EPItech Ghana is urging all Ghanaian businesses to audit their hosting and ensure their PHP versions are up to date.
By: T. Kwabena Date: 2026-10-23 11:49:24
