Why web application security needs a multi-layered approach

The recent PHP security emergency has highlighted how vulnerabilities in widely used web technologies can quickly become a significant cybersecurity concern. It is also a reminder that protecting internet-facing applications requires more than keeping software up to date. Organisations need a layered security strategy to protect applications, maintain availability and mitigate malicious traffic.

What happened in the PHP security emergency?

On 21 October 2026, the PHP security team released emergency updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both received a severity score of 9.2 out of 10 under CVSS v4.0. The vulnerabilities could allow unauthenticated attackers to execute code remotely on affected systems.

PHP is widely used to power websites, content management systems and web applications. Consequently, the vulnerabilities created potential exposure across a broad range of internet-facing services.

The incident prompted cybersecurity agencies to urge organisations to identify affected systems and apply security updates immediately. Some organisations also took vulnerable services offline while assessing their exposure and implementing fixes.

The situation illustrates the challenges of securing modern digital services. When a vulnerability affects widely deployed technology, organisations must identify exposed systems, coordinate remediation and assess whether their infrastructure has been compromised.

Why patching alone is not enough

Applying security updates is essential, but organisations also need to consider the wider range of threats targeting their applications.

Cybercriminals can exploit software weaknesses, attempt unauthorised access, use automated bots to abuse online services or launch distributed denial-of-service (DDoS) attacks to disrupt availability.

The consequences can extend beyond downtime. Successful attacks may compromise systems, expose customer data, interrupt business operations and lead to financial or regulatory penalties.

A multi-layered security strategy combines several complementary controls:

• Application security: Identifying and addressing vulnerabilities and protecting applications against exploitation attempts.

• Web Application Firewall (WAF): Inspecting web traffic to identify and block malicious requests.

• DDoS protection: Mitigating attacks designed to overwhelm application resources or congest network links.

• Automated bot mitigation: Detecting and managing malicious automated traffic that targets accounts, application functionality or data.

• Security monitoring: Identifying suspicious activity and supporting an effective incident response.

These controls address different threats and should complement, rather than replace, vulnerability management and timely patching.

When critical vulnerabilities like PHP2Shell are disclosed, the window between patch release and widespread automated scanning has shrunk from days to minutes. Attackers now leverage AI tools to reverse-engineer advisories, generate polymorphic exploit payloads and scan globally at scale. Relying solely on manual patch cycles leaves applications exposed during this critical time-to-remediate gap.

How PCCW Global helps protect web applications

PCCW Global offers managed security solutions that help organisations protect their networks, applications and digital services against a range of cyber threats.

Managed Anti-DDoS

Attacks that overwhelm computing resources or congest network links can prevent legitimate users from accessing essential services. PCCW Global’s Managed Anti-DDoS helps protect applications, websites and networks against large-scale DDoS attacks.

By mitigating malicious traffic, the service helps organisations maintain the availability of digital services and reduce the operational impact of attacks.

Managed Cloud WAF Service

A WAF inspects HTTP and HTTPS traffic to identify potentially malicious requests targeting web applications. PCCW Global’s Managed Cloud WAF Service helps prevent security breaches, block unauthorised access and detect and mitigate attempts to modify or copy critical system data and code.

WAF capabilities can provide an additional layer of defence against known attack patterns, depending on the vulnerability and available protections. However, they cannot guarantee protection against every exploit and applying the relevant security updates remains essential.

Additionally, while traditional firewalls look for known attack patterns, modern web threats constantly morph. PCCW Global’s Managed Cloud WAF incorporates machine learning and adaptive behavioural modelling to inspect traffic intent in real time. By establishing baseline behavioural patterns for application traffic, it can identify and intercept zero-day exploits and evasion techniques even before specific vendor signatures exist.

Automated bot mitigation

Malicious bots can attempt account compromise, abuse application functionality and collect information at scale. Through technology partners’ capabilities, PCCW Global can help organisations identify and manage malicious automated traffic.
Combined with WAF and DDoS protection, bot mitigation adds another layer of defence against application-level threats, helping distinguish malicious activity from legitimate traffic.

Modern bot attacks are no longer simple high-volume scripts. Cybercriminals increasingly deploy AI-powered bots capable of solving CAPTCHAs, imitating natural user browsing behaviour, and evading IP-based rate limiting to execute credential stuffing, scraping and account takeovers. PCCW Global leverages advanced machine-learning telemetry to analyse contextual signals (such as device fingerprinting, session dynamics and behavioural biometrics), neutralising automated threats without creating friction for legitimate customers.

Managed Firewall

Application security also depends on controlling access to the supporting network infrastructure. PCCW Global’s Managed Firewall continuously monitors network traffic and blocks unauthorised connections from untrusted or unapproved sources.

Together, these controls support a broader security strategy spanning network access, application traffic and service availability.

Building resilience beyond the next vulnerability

The PHP security emergency demonstrates how quickly a software vulnerability can create widespread exposure. Organisations must be prepared to identify affected systems, apply security updates and investigate potential compromise.

At the same time, they need protection against the wider range of threats targeting internet-facing applications. By combining application security, DDoS protection, automated bot mitigation and network access controls, organisations can strengthen their defences and help maintain the reliability of digital services.

As threat actors weaponise automation and AI to accelerate exploit cycles, passive and signature-only defences are outmatched. A resilient, multi-layered security strategy requires adaptive, AI-augmented intelligence paired with managed 24/7 oversight, enabling organisations to neutralise threats at machine speed before they impact the business.

The goal is not simply to respond to the latest security emergency, but to build a security strategy that helps prepare for the next one. Learn more about how PCCW Global’s security solutions can keep your network, apps and sensitive data protected.