Pakistan on Cyber Alert as PHP Flaws Trigger Global Shutdowns; National CERT Audits 300 Govt Websites

*Critical CVEs with CVSS 9.2 put 77% of web at risk; UK launches Be Ready 72-hour survival campaign as Black October hits 20 countries*

By Asad Kharal

ISLAMABAD : Pakistan has been placed on high cyber alert after two critical vulnerabilities in PHP, the programming language that powers up to 77% of the world’s websites, forced governments across Europe, Asia and the Americas to take their official portals offline as a precaution.

Pakistan’s *National Cyber Emergency Response Team (National CERT / Pak-CERT)* has accelerated emergency audits across public infrastructure. According to official data, *300 government websites are targeted for security evaluation and 280 have already been completed — 93% of the target*.

The audit has uncovered *broad systemic vulnerabilities, including critical server misconfigurations, weak web applications and severe risks for data leaks*. As a defensive measure, non-essential services are being transitioned to *read-only mode*, Web Application Firewalls (WAF) are being mandated, and emergency patching is underway.

*The Core Vulnerabilities:*

The crisis, dubbed *PHP2Shell and Black October* by cybersecurity researchers, involves:

– *CVE-2026-109618 (Partial Request Initialisation)*
– *CVE-2026-109619 (Stale State Reuse)*

Both carry a *CVSS 4.0 score of 9.2/10*, rated Critical. They allow *Unauthenticated Remote Code Execution (RCE)* — an attacker can take complete control of a web server without a password by exploiting memory corruption during out-of-memory conditions.

The bugs have existed undetected for over a decade, from *PHP 5.4 up to PHP 8.5*. Upgrading WordPress, Drupal or Joomla does not fix it, as the issue lies in the base PHP runtime itself.

The flaws were discovered with the help of AI models by researchers at *Calif, OpenAI and Wiz*. The timeline moved faster than traditional disclosures, with security firms reporting a race to exploit.

*Latest Updates – 24 October 2026:*

*1. Active Exploitation Confirmed:*
Cloudflare reported *millions of automated attack attempts* in the hours after disclosure, starting with thousands and escalating rapidly. Amazon Threat Intelligence detected an attempted exploit on a honeypot on *October 17, four days before public disclosure*, indicating the vulnerability had leaked. Security firm watchTowr confirmed *in-the-wild exploitation on October 21*.

*2. Third Vulnerability Reported:*
A third related issue, *CVE-2026-115560*, involving `session.upload_progress` was detected on October 23. As a temporary mitigation, administrators are advised to set `session.upload_progress.enabled=0` in http://php.ini until a full patch is released.

*3. Global Impact:*

– *Netherlands:* Deeply impacted — National Cyber Security Centre, DigiD, http://Overheid.nl, MijnOverheid, Port of Rotterdam, major hospitals and political parties forced services offline.
– *France:* Interior Ministry shut all prefecture sites.
– *Germany:* Federal IT provider ITZBund shut services.
– *Belgium:* Foreign Ministry and Smartschool platform affected.
– *Finland & Denmark:* Government IT centre Valtori and Denmark’s Aula school communication platform and Meteorological Institute services taken offline.
– *United Kingdom:* Major city councils including Oxford, Bristol and Edinburgh offline. On October 23, the government launched a three-year *”Be Ready”* campaign, advising households to stock *three days of non-perishable food, 9 litres of water per person, cash, torch, first-aid kit and a battery-powered FM radio* to survive 72 hours of disruption to electricity, communications and payments.
– *Japan:* Finance Ministry, Tax Agency, Meteorological Agency, and private firms including Nomura, Mitsubishi UFJ, ANA Airline and East Japan Railway affected.
– *Australia, Brazil, US, Canada:* Government document systems and cyber agencies issued urgent advisories.
– *Major Platforms:* Wikipedia, Internet Archive and other large platforms using PHP also took precautionary measures.

*4. Black October:*
October 2026 is being called Black October because alongside PHP, critical simultaneous flaws hit *Node.js (Node2Shell, CVSS 9.8)* in the Brotli decoder, and *Next.js*. More CVEs were published in the first nine months of 2026 than in all of 2025, driven by AI-assisted discovery.

*5. Still Unpatched:*
In *Denmark alone, over 21,000 websites* remain unpatched as of October 24, mostly small and medium businesses. In *India’s Tamil Nadu*, officials confirmed *10 government PHP sites were patched today, 2 are being fixed and 4 were found safe*, with no major citizen portal vulnerable.

*What is the Fix?*

1. *Apply Official Runtimes:* Upgrade immediately to patched releases issued on October 21: *PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35*. Restart PHP workers / Apache / PHP-FPM after patching.
2. *Handle Legacy Systems:* *PHP 8.1 and older are End-of-Life*. Obtain emergency backported patches from Long-Term Support vendors like Red Hat, Ubuntu or CloudLinux, or migrate to PHP 8.2+.
3. *Temporary Workaround:* Set `session.upload_progress.enabled=0` in http://php.ini.
4. *Log Monitoring:* Audit logs for multipart requests followed by memory-limit failures or HTTP 500 crashes, and for unusual PHPSESSID cookies.
5. *Server Verification:* Running `php -v` in CLI only shows the CLI version. Check hosting panel (cPanel) or application handler configuration to confirm the true version serving live traffic.

Pakistan’s National CERT advisory *NCA-19.211026* urges all public and private sector operators to patch immediately and take vulnerable systems offline if patching is not possible.