In brief
- Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell) can let an attacker run code on a web server without logging in.[php]
- IT leads the technical fix. HR and management should provide oversight by confirming that someone owns the risk, that the work is finished, and that the evidence exists.
- This article is general guidance, not legal or technical advice. Confirm specifics with your IT team, vendors and legal adviser.
What happened
PHP is a programming language that runs behind many websites and web applications. On 21 October 2026, the PHP project released emergency security updates for two flaws, both rated 9.2 (critical) on the CVSS v4.0 scale.[php]
The project said all PHP installations serving web requests are at risk. It rated the risk highest for servers running Apache with mod_php, where a demonstrated attack can trigger before any application code runs.[php]
The response was large and fast:
- Reports said dozens of British and Finnish government services were taken offline, and many French local government sites were briefly taken down.[npr]
- The US National Security Agency advised organisations that could not update immediately to take affected systems offline until they were fully mitigated.[freep]
- Cloudflare’s chief executive said attempts to exploit the flaw rose from tens of thousands in the first 45 minutes to millions.[npr]
A Malaysian reference point: one unrated industry blog reports that NACSA, the National Cyber Security Agency, warned organisations using PHP websites on 21 October to prioritise the update, and that MyCERT followed. Check the official NACSA and MyCERT advisories directly.
How widely PHP is used
According to W3Techs, PHP is used by 69.2% of websites whose server-side programming language is known (data dated 29 October 2026).[w3techs]
Two limits apply to that figure:
- It does not count all websites or business systems in the world, because it covers only sites whose language W3Techs can identify.
- It does not mean 69.2% of websites are vulnerable or compromised. It shows how common the technology is.
W3Techs also reports that every WordPress site in its sample uses PHP. Many corporate websites, recruitment pages and portals therefore sit on PHP, whether or not anyone in HR knows it.[w3techs]
Why this concerns HR and management
Think of the systems that hold or process people data:
- Recruitment portals and career pages
- Employee self-service and leave systems
- Learning management systems
- Custom internal applications and forms
Some may run PHP and some may not. The task is to find out, not to assume either way.
The reported consequences of successful exploitation include attackers taking control of servers, stealing sensitive data and defacing websites. For HR, that could mean exposed candidate or employee records, disrupted payroll or recruitment, and reputational damage.[npr]
Why IT should not carry this alone
Technical staff are best placed to assess servers, apply updates and investigate. But the business consequences go beyond the server:
- Deciding whether to take a service offline means weighing payroll deadlines, hiring campaigns and employee access.
- Judging whether personal data may be involved needs input from HR, legal and compliance.
- Vendor-hosted systems depend on contracts and written commitments, which are management and procurement matters.
- Unresolved risks need a senior decision-maker, not a quiet note in a ticket.
A check-and-balance role does not mean second-guessing technical decisions. It means asking whether the right things were done, who confirmed it, and what happens if they were not.
Who does what
| Function | Role |
|---|---|
| IT / security | Assess exposure, apply updates, investigate possible compromise |
| HR | Identify affected people processes, prepare employee communications and workarounds |
| Procurement / vendor management | Obtain written confirmation from providers, follow up on contractual duties |
| Legal / compliance / DPO | Assess personal data implications and notification duties |
| Management | Assign ownership and deadlines, approve downtime, decide on unresolved risks |
Checklist for your next IT or vendor discussion
Each question includes the reason to ask it.
- Are any of our systems affected, including vendor-hosted ones? Exposure depends on the technology behind each platform, and vendors often manage servers on your behalf.
- Which PHP version is each system running? The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project, though some distributions and long-term-support vendors provide their own backported fixes.[php]
- Have the updates been applied, tested and documented? The PHP project states that updating is the only complete solution and that interim settings reduce exposure but do not make an installation safe.[php]
- If updating is delayed, what temporary protection exists, and when will the work finish? A date creates accountability, and a stopgap is not a fix.
- Has the team checked for signs of compromise, not only installed the update? Updating does not remove an attacker who got in earlier. One security report recommends reviewing logs back to June 2026 for web shells, modified files, new unauthorised admin accounts and unusual outbound connections. Treat this as one reported recommendation and ask your IT team to confirm the right scope.[thenews.com]
- Could the work disrupt payroll, recruitment or employee access, and what is the fallback? This is a business continuity question that only the business can answer.
- If personal data may be affected, who escalates to management, legal and the DPO? Decide this before an incident, not during one.
Malaysian compliance context
Under the Personal Data Protection Act 2010, organisations acting as data controllers now have breach notification duties, in force from 1 June 2025. A law firm summary of the Personal Data Protection Commissioner’s guideline reports these key points:[linkedin]
- Notification to the Commissioner is expected no later than 72 hours from knowledge of a breach that causes or is likely to cause significant harm.
- Significant harm includes factors such as sensitive personal data, financial loss, identity fraud risk, or more than 1,000 affected data subjects.
- Affected individuals must be notified within 7 days of notifying the Commissioner.
- Controllers should have a breach management and response plan, with periodic training and simulations.
- Data processors must notify the controller, and controllers should place that obligation in the contract.
This summary comes from a secondary source, so verify the details against the Commissioner’s official circular and guideline. A vulnerability alone is not a breach. What matters is prompt assessment of whether personal data was actually accessed or exposed. Whether your organisation falls under the Cyber Security Act 2024 as a critical information infrastructure entity is a separate question for your legal and compliance team.
What to do this week
- Ask IT for a written list of PHP-dependent systems and their status.
- Ask each vendor handling HR data for written confirmation of patching and compromise checks.
- Check that your breach response plan names the people involved, including HR and the DPO.
- Make sure someone with authority can approve downtime quickly.
- Record the outcome so you can show what was checked and when.
Closing thought
“IT is handling it” should be the start of the follow-up, not the end of the conversation. Digitalisation means more than putting processes online. It means building accountability around the systems you depend on.
Further reading
- Official PHP security advisory on php.net (21 October 2026)
- National Cyber Security Agency (NACSA) and MyCERT advisories
- Personal Data Protection Commissioner: Data Breach Notification Circular and Guideline
- W3Techs: PHP usage statistics