One Request, No Password: What PHP2Shell Means for Nigerian Websites

Adam Bashir — Fri, 23 Oct 2026 18:43:27 GMT

A flaw buried in PHP since 2004 allows attackers to seize web servers without a password. Nigeria’s websites are unusually exposed, and the remedy begins with knowing what you run.

By Adam Bashir

Somewhere in Nigeria tonight, a university portal, a ministry website or a modest online shop is running software that would let a stranger take control of its server without ever being asked for a password. A fix has been available since Wednesday. Whether anyone responsible for those sites has applied it is another matter entirely.

The story began, as such stories increasingly do, with a leak. On the morning of Tuesday, 20 October 2026, a post on Hacker News claimed that two serious vulnerabilities in PHP were about to be disclosed. The post was soon removed, but screenshots had already circulated (Nextgov). By the following afternoon, PHP had released emergency fixes a day ahead of schedule, and the NSA, FBI and CISA were urging organizations to update their systems or take them offline.

Collectively known as PHP2Shell, the two flaws allow an attacker to execute commands on a web server without authenticating. Their reach is difficult to overstate. According to W3Techs, PHP powers roughly 70% of websites whose server-side language can be identified, including those built on WordPress, Drupal and Joomla. If your business, school or agency maintains a website, PHP may well sit beneath it.

Nigeria’s official response, so far, has consisted of a brief post from ngCERT on X urging the public to “Patch Now!” (TechNext). The advice is sound, but it leaves the essential questions unanswered: what a business owner should ask of their developer, and what a developer should do with a site still running PHP 7. This article attempts to answer them, drawing on what PHP and the principal security advisories have published.

What happened

The vulnerabilities, CVE-2026–109618 and CVE-2026–109619, each carry a severity rating of 9.2 out of 10. PHP’s own advisory states that every installation serving web requests is at risk, whether it runs on PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. The danger is greatest under mod_php, where a demonstrated attack succeeds before any of the site’s own code has run (PHP).

That last detail is more consequential than it may first appear. Security plugins, framework middleware and carefully written login pages all operate within the application, and the attack arrives before the application has loaded. However well a site has been built, its own defenses cannot intervene.

PHP released the following fixed versions on 21 October:

For PHP 8.1 and earlier, there will be no official release. The project has published minimal source patches for 7.4, 8.0 and 8.1 for those who compile PHP themselves, and otherwise directs users to their Linux vendor or to an upgrade (PHP). Since PHP 8.2 reaches end of life on 31 December, any site still on 8.1 or older would be better served by moving directly to 8.3 or later, provided its code allows.

What makes PHP2Shell remarkable is not only its severity but its age. The memory-handling flaws at its root have been present since the release of PHP 5 in July 2004 (SC Media). They were found this year by researchers at Calif, working with OpenAI’s GPT-5.6 Sol model, and independently by Wiz (Nextgov); PHP received the first reports on 11 August (Sophos). A defect that went unnoticed for twenty-two years was finally surfaced with the help of artificial intelligence, a reminder that such tools are available to attackers as readily as to defenders.

Nor did attackers wait for the formal announcement. Amazon’s threat intelligence team observed an exploitation attempt on 17 October, four days before the fixes were made public (Sophos), and Cloudflare and watchTowr have since reported further attempts (SC Media). Wiz, for its part, has demonstrated working attacks against WordPress, Drupal and Joomla, and shown that passwords and access credentials can be read directly from a server’s memory (Nextgov).

Why Nigeria should be concerned

As far as I can establish, no one has published figures on how many Nigerian websites run outdated versions of PHP. The global picture, however, is sobering. One internet scan this week counted 4.4 million exposed PHP services, roughly 79% of which were running versions PHP no longer supports, according to the chief technology officer of Suzu Labs (SC Media). Those servers will never receive an official fix.

There is little reason to believe Nigeria fares better. Many websites here are commissioned as one-off projects, delivered without a maintenance agreement, and left to run unattended once the original developer has moved on. A server that belongs to no one is a server that no one updates.

Other governments in the region have responded with considerably more urgency. According to TechNext, Kenya issued a binding directive on 21 October requiring government bodies to audit their hosted applications and shut down any portal that could not be patched. A day later, Ghana’s Cyber Security Authority and National Information Technology Agency reportedly gave public institutions seven days to inventory their PHP deployments, apply the updates and submit remediation reports (TechNext). As of 23 October, I have found no comparable instruction from any Nigerian authority.

When a breach becomes a legal matter

The absence of a directive, however, is not the absence of an obligation. Under the Nigeria Data Protection Act, a data controller must notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach that is likely to put individuals’ rights at risk. Where that risk is high, section 40(3) further requires the controller to inform the affected individuals directly and without delay (Lex Mundi).

The penalties are substantial. An organization designated a data controller of major importance, a category that includes universities, government agencies, commercial and microfinance banks, and payment gateway providers, may be fined up to N10 million or 2% of its previous year’s gross revenue, whichever is greater. The Commission has already shown its willingness to act, having fined Fidelity Bank N555.8 million (Lex Mundi).

Organizations should also look further back than last week. Because PHP received its first reports in August, Sophos recommends reviewing activity on exposed systems from 1 August onwards (Sophos).

What to do this week

If you own a website but do not manage it yourself, put the following questions to your developer or hosting provider today, and ask for the answers in writing:

Which version of PHP is the site running? It should be 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later.
If it runs PHP 8.1 or older, when will it be moved to a supported version?
Does the same hosting account contain anything else, such as an old test site or a portal that is no longer in use?
Have the server logs been reviewed for suspicious activity dating back to 1 August?
Which database passwords and payment gateway keys are stored on the server, and will they be changed?

If you are the developer or administrator, I would proceed in this order:

Locate every PHP installation, including staging sites, forgotten subdomains and XAMPP or WAMP setups on office machines. Sophos advises confirming each version from the PHP binary itself rather than from an asset register.
Apply the update, then restart every PHP-FPM or web server worker so that the new version is actually loaded. By 21 October, fixed packages were available for Ubuntu 22.04 and later, Debian 12 and 13, and cPanel’s EasyApache 4 (version 25.91), while Red Hat’s were still pending (Tanium). Confirm the position with your own vendor rather than assuming.
If you cannot update immediately, take the site offline or place it behind a login or VPN. PHP lists several interim settings: memory_limit=-1, configured so that applications cannot override it; a low post_max_size (8M where the site accepts no uploads, 32M where it does); and session.upload_progress.enabled=0, set in php.ini or the FPM pool rather than through ini_set() or .user.ini. PHP is explicit that these measures reduce exposure but do not make a server safe (PHP).
Leave session.upload_progress.enabled=0 in place even after updating. On 23 October, PHP asked users to keep it disabled until the next regular release, owing to a further, less likely issue tracked as CVE-2026-115560 (PHP).
Look for signs of compromise. Sophos highlights file-upload POST requests to pages that do not normally accept uploads, requests containing a PHP_SESSION_UPLOAD_PROGRESS field, spikes in memory errors or worker crashes, unfamiliar PHP files in the web root, and outbound connections from PHP to unexpected addresses (Sophos).
If you find anything, treat it as a breach: change database passwords and payment gateway keys, and begin the NDPA’s 72-hour notification process.

The slow part

Once the details had leaked, PHP shipped a fix in roughly a day. The slow part, as ever, falls to everyone else: establishing which servers run PHP, which versions they run, and who is accountable for them. If you cannot answer those questions about your own website today, you already know how to spend this weekend.

Adam Bashir is a software engineer and cyber security analyst based in Abuja, and a member of the British Computer Society (MBCS). He writes about security, software and the systems Nigerians rely on every day.