Security guide
PHP Security Alert (php2shell): Is Your Business Software Safe?
In October 2026 PHP, the language behind a large share of the world’s websites, fixed two critical flaws known as php2shell. Many shop, khata and installment programs in Pakistan run on PHP. Here is what happened, why it matters for business data, and how to check your own software — calmly, in plain words.
By Rana Yasir Ali, Founder & CEO6 min read
What happened in October 2026
On 21 October 2026 the PHP project released emergency fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, together called php2shell and rated 9.2 out of 10. Cloudflare’s advisory says web servers running PHP 5.4 or later are affected.
The first flaw is in how PHP handles running out of memory: its clean-up can treat half-built data as if it were complete. The second leaves references to memory that has already been freed after a fatal error, so a later request on the same server process can reach data from an earlier one. Together they can let an attacker with no account run code on the server, or read data such as passwords and session keys.
Attacks were seen in the wild within days. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are past their end of life and have no official fixed release.
On 23 October PHP disclosed a third, narrower flaw, CVE-2026-115560, in the session upload progress feature. It is not yet patched; the advice until then is to switch session upload progress off.
Why business data is different from a blog
A hacked blog can be restored from a backup. A business database is different: once it has been read, it cannot be taken back. In a shop, a distribution house or an installment showroom it holds:
- Customer and guarantor names, CNIC numbers, phone numbers and addresses
- Receivable balances and installment schedules
- Supplier ledgers, purchase rates and margins
- Cash, bank and staff records
Four checks for your current software
- 1Ask your software vendor which PHP version your system runs on, and whether it was updated to a fixed release (8.2.35 or newer) after 21 October 2026. Ask for the answer in writing.
- 2Look at the address you log in at. If it ends in .php (for example login.php or index.php), your software runs on PHP. That is not wrong by itself — but it must be patched.
- 3If it runs on shared hosting or cPanel, ask who updates PHP on that server. If the answer is PHP 8.1 or older, there is no official fix: the system needs to move to a supported version.
- 4A firewall such as Cloudflare’s in front of the site helps, but Cloudflare itself calls its rules a stopgap. The fix is the PHP update. If you are unsure whether an unpatched server was exposed, change passwords and keep a fresh backup.
HisabMate
HisabMate is not affected by php2shell
HisabMate does not use PHP or WordPress anywhere. It runs on a modern non-PHP stack with a managed PostgreSQL database, so the php2shell flaws do not apply to it. Beyond that, your data is protected by design:
- Separate data for every business, checked by the database on every read and every save
- Staff permissions enforced inside the database, not only on the screen
- Every payment saved exactly once; sales and payments save completely or not at all
- A record of deleted documents, price changes and every user’s entries
- Encrypted HTTPS between the website, the web app, the Android app and the server
- Moving from older software? Bring your items and balances in from Excel
Questions
Is HisabMate affected by the October 2026 PHP (php2shell / CVE-2026-109618 & CVE-2026-109619) vulnerability?
No. HisabMate does not use PHP, WordPress or shared-hosting PHP scripts. It runs on a modern non-PHP stack with separate data per business, permissions enforced inside the database and all-or-nothing transactions.
My software runs on PHP. What should I do today?
Ask your vendor, in writing, which PHP version it runs and whether it was updated to a fixed release (8.2.35 or newer) after 21 October 2026. If it runs PHP 8.1 or older, there is no official fix and it needs to move to a supported version.
Is a firewall enough?
No. A firewall such as Cloudflare’s blocks known attack patterns and buys time, but Cloudflare itself calls its rules a stopgap. The fix is updating PHP.
Roman Urdu
Kya October 2026 wale PHP (php2shell) security bug se HisabMate ko koi khatra hai?
Nahi. HisabMate mein PHP ya WordPress bilkul istemal nahi hota, is liye yeh bug is par laagu nahi hota. Aap ke karobar ka khata, stock aur qist ka record har business ke liye alag rehta hai, aur database khud check karta hai ke kaun kya dekh sakta hai.
Mera software PHP par chalta hai, ab kya karoon?
Apne software wale se likh kar poochein ke PHP ka kaun sa version chal raha hai aur 21 October 2026 ke baad update hua ya nahi (8.2.35 ya naya). PHP 8.1 ya purana ho to us ka official fix nahi aayega.