PHP2Shell: what the PHP emergency means for your business website

If your website runs on PHP, it needs an update this week, not next quarter. On October 21, 2026, the PHP project shipped emergency fixes for two critical flaws, nicknamed PHP2Shell, that can let a stranger take over a web server without a password.

PHP is the software underneath a huge share of the web. It runs WordPress, Joomla, Drupal, Moodle and countless custom sites and booking tools. WordPress alone powers roughly 40 percent of all websites, and estimates put PHP behind close to 70 percent of sites overall.

The UK's National Cyber Security Centre and CISA both told organizations to take PHP systems offline if they cannot patch right away. Several Dutch organizations, including their national cyber security center, pulled their own sites offline as a precaution. When government security agencies say "unplug it," a local business owner should pay attention.

This post is the plain-English version: what happened, whether it is being used against real sites, how to find out if yours is exposed, and what to ask your developer or host today.

What PHP2Shell is, and why it is different

PHP2Shell is the nickname for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. Both let an attacker run their own code on your server with no login and no click from anyone on your team.

In plain terms:

• The first flaw corrupts memory when PHP runs out of memory partway through handling a request. An attacker can trigger that on purpose.
• The second flaw lets one request leave behind stale data that the next request on the same server process reuses. That leftover data can be turned into a foothold.

Here is the part that matters for business owners. Most website security lives inside your application: strong passwords, plugin updates, login limits. PHP2Shell happens before any of that runs. It sits in the engine itself, while PHP is still reading the incoming request. A carefully built custom app is just as exposed as a WordPress site that has not been touched in three years.

The flaws were found this summer by security researchers at Calif and Wiz, in an audit funded by OpenAI. The PHP maintainers and a group of security companies spent about two months preparing a fix in private. Then details leaked on a developer forum a day before the planned release, which is why the patch went out in a hurry. Security writers are already comparing it to Log4Shell, the 2021 flaw that had the whole industry patching at once.

Is anyone actually using it?

Attackers are trying, and they started early. As of October 23, there is still no public confirmation of a successful break-in.

• October 17: Amazon's honeypots record the first known attempt, four days before the fix existed.
• October 20: Details leak. PHP announces an emergency release.
• October 21: PHP releases fixes. watchTowr and Cloudflare report early attacks. CISA says it has not yet seen exploitation.
• October 22: Sansec, which predicted mass attacks within minutes of the patch, says public exploits fail against PHP's default settings and need specific server conditions. NSA and CISA urge immediate patching.
• October 23: Researchers tie attack attempts to a Mirai botnet. PHP discloses a separate session-handling flaw (CVE-2026-115560) that this week's patch does not fix. Neither PHP2Shell flaw is on CISA's Known Exploited list yet.

The honest read: the public attack tools are not yet a reliable skeleton key, and that is buying everyone time. It will not last. The NSA expects attackers to weaponize these flaws, and the gap between disclosure and working attacks keeps getting shorter. Treat the quiet as a head start, not an all-clear.

Are you affected?

If your site runs PHP and has not been updated since October 21, assume yes. Every PHP setup that serves web pages is in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team flags Apache with mod_php as the highest-risk setup.

The fixed versions are:

• PHP 8.5: 8.5.12 or later (actively supported)
• PHP 8.4: 8.4.27 or later (actively supported)
• PHP 8.3: 8.3.36 or later (security fixes only)
• PHP 8.2: 8.2.35 or later (security fixes only, ends December 31, 2026)
• PHP 8.1 and older: no official release. Source-only backports exist for 7.4 through 8.1. Plan an upgrade.

The older-version line is the one that worries us. One security firm counted about 884,000 internet-facing servers reporting PHP 8.1 or older, more than half of all servers that report a version at all. Small business sites built years ago and never maintained land here more often than anyone likes to admit.

You do not need to be technical to find out where you stand. Send one of these to whoever runs your site:

• If you use a host like GoDaddy, Bluehost, SiteGround or a cPanel/Plesk account: "What PHP version is my site on, and has it been updated for PHP2Shell?"
• If a developer or agency built your site: "Is our server on a patched PHP version from October 21 or later? If not, when?"
• If you are on Squarespace, Wix, Shopify or Webflow: you are likely not running your own PHP. Confirm with support, but this one is mostly on them.
• If nobody knows who manages the server: that is the real problem, and it is worth fixing this week regardless of PHP2Shell.

One trap to avoid: running a routine system update does not guarantee you landed on a fixed version. Ask for the actual version number.

What to do this week

Patch first, then check whether anyone got in before you did. In order:

1. Find out who owns your server. Host, developer, agency or you. Get a name and a way to reach them today.
2. Get on a fixed PHP version. 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer. Start with anything public-facing: your website, booking pages, client portals, intake forms.
3. If it cannot be patched right away, take it offline. That is CISA's and the UK NCSC's advice, not ours. A maintenance page for two days costs less than a compromised server.
4. Do not lean on a firewall alone. Cloudflare and AWS have both pushed blocking rules, and they help. PHP's own developers say no mitigation fully blocks these attacks, and Cloudflare calls its rules temporary.
5. Look for signs of a break-in. Patching closes the door but does not remove anyone already inside. Ask your developer to check for new or unfamiliar files in the website folder, new scheduled tasks, and new admin accounts.
6. Plan the upgrade if you are on PHP 8.1 or older. You will not get a normal fix. A site that old usually has other problems waiting too.
7. Watch for the follow-up. PHP disclosed a separate session-handling flaw on October 23. Its advisory suggests keeping the session upload progress feature turned off until the next regular release. Your developer will know what that means.

If steps 1 or 5 left you stuck, that is normal. Most small businesses we talk to do not know who has the keys to their server until something like this happens.

The real lesson: someone has to own your site after launch

PHP2Shell is not a story about bad code on your website. It is a story about the layer under it, the part most owners never see and assume someone else is watching. When a flaw like this lands, the businesses that come through fine are the ones with a named person who patches the server within a day.

The ones that get hurt are running a site that was built, handed over and left alone. Nothing looked broken, so nobody looked.

If you inherited a site and are not sure what it runs on, our Software rescue work starts with exactly that question.

Not sure where you stand? Run your site through our free Site X-ray, or book a call and we will tell you, in plain terms, whether PHP2Shell is your problem and what it takes to fix. You can also call us at (602) 587-1003.

Sources

• Help Net Security: PHP2Shell patched, update now
• BleepingComputer: PHP ships emergency patches for PHP2Shell
• Dark Reading: PHP2Shell bugs signal red alert
• SiliconANGLE: Critical PHP vulnerabilities send organizations scrambling
• CyberScoop: PHP releases emergency fixes
• SecurityWeek: Mirai botnet operators join PHP2Shell attacks
• Techzine: Why PHP2Shell affects every company
• The Hacker News: PHP2Shell emergency security alert
• ExecutiveGov: NSA, CISA urge immediate patching
• Greenbone: PHP2Shell remote code execution
• SOCRadar: PHP2Shell timeline and status
• AWS Security Blog: AWS WAF mitigations for PHP2Shell
• itdaily: PHP2Shell actively exploited ahead of patch
• Impacto TIC: PHP2Shell and WordPress share