What happened?
On 21 October 2026, the PHP developers released emergency updates for two vulnerabilities that have become known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). Both are rated critical at 9.2 out of 10. They sit in the core of PHP itself, not in any particular application, and according to security researchers affect every version from PHP 5.4, released in 2012.
Put simply, certain requests make PHP keep working with memory that has already been released. In the worst case, an attacker can use this to run their own code on the server. One of the two vulnerabilities can also leak data from memory, such as passwords or access keys.
The details were originally due to be published on 22 October. Because they leaked in advance, the updates were released a day early.
Am I affected?
Every web server on which PHP handles requests from the internet is affected. For small businesses, this mainly means:
- Websites with WordPress, Joomla, TYPO3, Contao or similar systems
- Online shops with WooCommerce, Shopware or Magento
- Classic hosting plans with a contact form, booking system or customer area based on PHP
- Your own or rented servers running PHP applications, for example webmail or internal tools
Not affected are websites that consist only of ready-made HTML pages and are served without PHP. With website builders that run the servers themselves, the provider takes care of the update.
How to find out your PHP version
- In your hosting provider’s customer area: With most providers you will find the version currently set under “PHP settings” or “PHP version”.
- In WordPress: Go to Tools → Site Health → Info and check the PHP version in the “Server” section.
- Ask your hosting provider: A short message is enough: “Has PHP on my plan already been updated against PHP2Shell?”
Important: even if it says “PHP 8.3”, the plan is only safe if the updated build runs underneath, in this case 8.3.36. Large hosting providers usually install such updates themselves, but with a vulnerability of this size you should not rely on that alone.
What to do now
- Confirm the update: Check with your hosting provider or IT service provider that PHP runs on one of the versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or on a build into which the provider has backported the fix.
- Replace outdated versions: PHP 8.1 and earlier no longer receive updates from the PHP project. Some Linux vendors do ship their own fixes, but you can only rely on that if your hosting provider explicitly confirms it. Otherwise there is no way around switching. Make a backup first and check that your theme and plugins work with the new version.
- Update your own servers: If you run your own server, install the PHP packages from your Linux distribution and then restart the PHP services so that the old version does not keep running.
- Look for traces: First attack attempts were observed even before the disclosure. Check for new administrator accounts, unknown files or unusual error messages, such as repeated memory errors in the PHP logs. If anything looks suspicious, change the website’s passwords and access keys.
- If the update is not possible right away: A web application firewall can block known attacks. Cloudflare has made rules for this available to all customers, including on the free plan. The US agency CISA advises taking systems that cannot be updated offline until they are patched.
How dangerous is it really?
You should take the vulnerabilities seriously in any case: working attack code exists, and security firms have observed first attack attempts, according to Amazon as early as 17 October. In the Netherlands, several government and news websites were taken offline as a precaution.
At the same time, first analyses show that a successful attack requires certain conditions on the server. The example attacks published so far apparently do not work against a standard PHP installation without further steps. Mass exploitation is therefore considered less likely than first feared. That may change as soon as attackers improve their tools. It is not a reason to put off the update.
Conclusion
For most small businesses, the effort is manageable: check once which PHP version is running and have your hosting provider confirm that the update has been installed. It becomes critical mainly with old hosting plans on PHP 8.1 or earlier and with servers that nobody looks after regularly. That is where you should act now.
More on how we secure your systems: IT Security.