Morocco Issues Critical Cybersecurity Warning Over Two PHP Vulnerabilities

12:45

Morocco’s cybersecurity authorities have issued an urgent warning over two critical vulnerabilities affecting PHP, a widely used programming language that powers websites and web applications worldwide. The alert highlights the risks facing businesses, public institutions and digital service providers that rely on potentially vulnerable server configurations.

The General Directorate for Information Systems Security (DGSSI), operating under Morocco’s National Defence Administration, classified both vulnerabilities as critical in a security bulletin published on October 21, 2026.

Identified as CVE-2026-109618 and CVE-2026-109619, the flaws have been associated with the name “PHP2Shell”. Each received a severity score of 9.2 out of 10 under the CVSS version 4.0 assessment system, reflecting the potentially serious consequences of successful exploitation.

The vulnerabilities could allow attackers to execute malicious code remotely on affected systems without first obtaining authentication credentials. Depending on the server environment and the level of access achieved, an intrusion could expose sensitive information, compromise hosted applications or disrupt online services.

The availability of exploit code increases the urgency

The publication of proof-of-concept exploit code has heightened concerns among cybersecurity specialists. Such material can make it easier for malicious actors to test and adapt attacks against systems that have not been secured.

PHP is extensively used in web development, including by websites built with popular content management systems such as WordPress. Its widespread adoption means that vulnerabilities affecting certain PHP installations can have consequences across a broad range of online services.

However, the existence of these flaws does not mean that every website using PHP has been compromised. The actual level of exposure depends on the software version deployed, the server configuration and whether the relevant security updates have been installed.

For organisations operating online platforms, identifying vulnerable installations and responding quickly are therefore essential steps in reducing the risk.

Morocco faces exposure because of PHP’s widespread use

The alert is particularly relevant to Morocco, where PHP accounts for a substantial share of identifiable server-side technologies used by websites with the country-code domain “.ma”.

According to figures from W3Techs cited in reporting published on October 21, 2026, PHP was used by 75.4% of .ma websites for which the server-side programming language could be identified. The corresponding global share stood at 69.3%.

These figures illustrate the technology’s reach but should not be interpreted as the percentage of Moroccan websites that are vulnerable. They also exclude websites using other domain extensions, such as .com and .net, and sites whose underlying technology cannot be identified.

The distinction is important for businesses, government departments and other organisations assessing their exposure. A reliable assessment requires checking the actual software versions and configurations running on their infrastructure.

Security updates are available

The PHP development team has released corrective versions intended to address the two vulnerabilities. The updates include PHP 8.2.35, PHP 8.3.36, PHP 8.4.27 and PHP 8.5.12.

Organisations are advised to identify the versions installed across their servers and applications, then deploy the appropriate security updates without delay. Administrators should also verify that third-party services and applications incorporating PHP have received the necessary fixes.

Systems running PHP 8.1 or earlier require particular attention because these versions no longer receive regular security maintenance through the standard PHP release process. Migrating to a supported version is therefore recommended.

Where an immediate update is not possible, organisations should assess whether affected systems need to be isolated or temporarily taken offline until adequate protection can be established.

A reminder of the importance of proactive cyber defence

The DGSSI warning underscores the importance of maintaining software, monitoring vulnerabilities and responding promptly to security advisories. For organisations managing sensitive information or essential online services, delayed updates can leave infrastructure exposed even after a corrective release becomes available.

As Morocco continues to expand its digital services, the security of websites and online platforms remains a key operational concern. The immediate priority is to establish which systems are affected, install the appropriate patches and investigate any signs of suspicious activity.

The alert serves as a reminder that effective cybersecurity depends not only on identifying threats but also on ensuring that protective measures are implemented before vulnerabilities can be exploited.