The Maldives Police Service has issued a cybersecurity advisory warning of a critical vulnerability in PHP software, urging government institutions, businesses and website operators to take immediate steps to secure their systems.
The vulnerability, known as “PHP2Shell”, was highlighted in an advisory published on October 21, 2026. It carries a severity score of 9.2 under the Common Vulnerability Scoring System (CVSS v4.0), indicating a critical security risk.
According to the advisory, the vulnerability could allow attackers to execute code on affected servers without requiring a username or password, potentially enabling them to gain control of websites and online systems.
The police warned that the vulnerability could lead to the exposure of confidential information and disruption of online services, calling on organisations using PHP, including websites running on platforms such as WordPress, to ensure their systems are protected.
The advisory recommends upgrading PHP to one of the patched versions — 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — or a later official release. System administrators are also urged to coordinate with their hosting providers to verify that their servers are secured, strengthen system monitoring and regularly maintain additional security measures.
The police further advised organisations that suspect unauthorised access to their systems to preserve digital evidence and report the incident without delay.
If a cyberattack or unauthorised system access is suspected, the advisory urges affected parties to immediately disconnect the compromised system from the network and report the incident to the Maldives Police Service’s Cyber Crime Centre.
The advisory was issued jointly by the Maldives Police Service and the National Cyber Security Agency.
