At 22:00 WIB on 22 October 2026, Indonesia's Ministry of Industry (Kemenperin) switched off SIINas, its official website, and every kemenperin.go.id domain. The stated reason: mitigating cybersecurity risk from the PHP2Shell vulnerability. The ministry did not mention any breach, and the shutdown was scheduled to run until 25 October.

A ministry with its own IT team chose to take its sites down for days rather than leave them running one more night unpatched. That is an expensive decision. If the gap between a patch being released and a patch being installed can cost an agency that much, your website or online shop has no reason to wait.

PHP2Shell timeline from the 20 October warning to Kemenperin going offline on 22 October

What PHP2Shell is

PHP2Shell is the name for two flaws, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a server without logging in, and both score 9.2 out of 10 on CVSS v4.0, according to Bitsight. The root cause is shared: PHP can leave its memory corrupted when a request ends abnormally. The attacker's code then runs with the same privileges as the web process on your server.

The PHP security team rates the risk highest for Apache with mod_php, because a single unauthenticated request can trigger the attack before any application code runs. In other words, a tidy WordPress install or a freshly built online shop is not automatically safe. The problem sits underneath, in PHP itself.

The emergency patch landed on 21 October, a day after the PHP team warned admins to get ready. According to BleepingComputer, Cloudflare's CTO had already seen early attacks before the patch shipped, and firewall rules were only a stopgap. The safe versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For PHP 7.4, 8.0, and 8.1 the team only released minimal backports, and 8.1 and older no longer receive routine updates.

That last part is the worrying one. Bitsight's scans found that only about a third of PHP instances with a readable version run a branch covered by 8.2 to 8.5. The most common branch is PHP 7.4, with more than two million observations. VirusTotal estimates over 5.1 million PHP hosts are exposed to the internet.

PHP2Shell scale: 5.1 million hosts, a 9.2 score, over 2 million PHP 7.4 observations, and one third of versions covered by the update

The consequence is concrete. Many small business sites run on shared hosting or on a server their developer set up years ago and never touched again. Owners often do not know which PHP version they run, let alone who is responsible for updating it. On a day like this, not knowing is the biggest hole.

One note to avoid overreacting: a site that goes offline temporarily has not necessarily been breached. As Malwarebytes points out, downtime can simply be a protective step.

Two other flaws this month

PHP2Shell is the loudest in Indonesia, but not the only one. Two others deserve a check because attackers are using both.

GlobalProtect (CVE-2026-0257). This is a flaw in Palo Alto firewalls, specifically the GlobalProtect portal and gateway, that opens the way to an unauthorised VPN connection. A fix has been available since May 2026, and it was first rated only medium severity. According to Unit 42, the Qilin and Inc ransomware groups use it as an entry point, even bypassing MFA to set up a VPN session. The mitigation: install a patched PAN-OS, turn off or separate the Authentication Override certificate, and review VPN connection logs. This matters if your office runs those firewalls.

Windows Shell (CVE-2026-96951). This was fixed on Patch Tuesday, 13 October, alongside 1,411 other flaws, a record for a single Patch Tuesday, per BleepingComputer. This one is already being used by attackers. A specially crafted file can bypass Mark of the Web, so the warning and Protected View that normally appear when opening a downloaded file never show up, as Help Net Security explains. It needs someone to open the file, from email, chat, or a website. Tenable's Satnam Narang notes it is the third Windows Shell flaw exploited in the wild this year. The fix comes through Windows Update, but it has to reach every computer, not just the owner's.

Comparison of this month's three flaws: who is exposed and what to do today

What to do today

The core message is simple: check the version and patch now, not at next month's maintenance window. A flaw whose details are public and which attackers already use gives no such grace period.

For owners of a website or online shop, the five steps below are enough, and none requires you to code.

Five steps to check and patch PHP on a website or online shop
  1. Find out who owns PHP. Usually the developer or the hosting provider. Updating WordPress or its plugins is not the same as updating PHP.
  2. Get the version in writing. "It's secure" is not enough. Ask for the version number, for example the output of `php -v` on the server.
  3. Patch. The targets are 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you run 8.1 or older, ask whether your provider has a backport, or plan a move to a supported version.
  4. If you can't yet, limit access. Isolate it from the public network or switch it off for now, as Kemenperin did. A firewall alone does not close the hole.
  5. Confirm the result. The new version is actually running, the site looks normal, and the logs show nothing odd.

And one question worth asking now rather than after the next headline: if another emergency patch drops next week, who installs it, and how long does it take?

If you want someone to talk through checking your website or online shop, message XETUP on WhatsApp at +62 823 1499 5005.