PHP2Shell: two critical flaws in PHP. Check your website today.
PHP runs WordPress and a huge share of the web. Details of two serious flaws leaked early, attacks have started, and the NCSC says patch now. Here's what it means if you run a business website.
What's happened
On 21 October the PHP project released emergency fixes for two critical flaws, now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP's own security team rates both 9.2 out of 10. Together they can let an attacker run their own code on a web server without logging in, with a single web request, before any of the website's own code even runs.
The fixes were meant to come out on 22 October, but details leaked online the day before, so PHP brought them forward. Within hours, security firm watchTowr said it was seeing active attempts to exploit both flaws, and Cloudflare reported attack traffic against its customers.
The UK's National Cyber Security Centre (NCSC) has told organisations to update straight away. If that isn't possible, apply PHP's temporary workarounds, and if those can't go in quickly either, consider taking the affected system offline until it's fixed. Several public sector websites, including some councils and the Met Police, were taken offline on 21 October as a precaution.
Why this matters to your business
You may never have heard of PHP, but there's a good chance your website runs on it. It sits underneath WordPress, WooCommerce, Joomla, Drupal, Magento and Laravel, and most shared web hosting. If your website was built on any of those, it's probably affected.
A website that's taken over can be used to steal what customers type into forms, add card skimmers to a checkout page, send spam or phishing emails that look like they're from you, or get a foothold into other systems the web server can reach. Google may also flag the site as unsafe, which can do real damage to your enquiries.
The important bit: updating WordPress or its plugins does not fix this. PHP is the layer underneath, so it has to be updated on the server itself, usually by your web host or whoever manages your server.
Who is affected
- Any website that runs PHP and serves web pages, whichever way it's set up (PHP-FPM, Apache with mod_php, LiteSpeed and others). PHP says the risk is highest with mod_php.
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ubuntu and cPanel have also published fixed packages.
- Older versions: PHP 8.1 and older are no longer supported, so there's no official fix. Some vendors are offering their own patches, but the real answer is moving to a supported version.
- Probably not you: if your site is on a fully hosted platform like Wix, Squarespace or Shopify, the platform looks after its own servers. It's still worth checking their status page.
What to do today
- Find out what your website runs on and who hosts it. If you don't know, your web designer or whoever sends the hosting invoice will.
- Ask your host or developer one direct question: "Have you installed the PHP2Shell fixes (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your patched build) on our server?" Get a yes in writing. The free PHP2Shell checker tells you if a PHP version is patched and gives you a message to send your host.
- If you manage the server yourself, update PHP now, restart PHP and the web server, and check the version afterwards. In cPanel, switching PHP version doesn't install the fix: the update has to be applied.
- If you're on PHP 8.1 or older, plan the move to a supported version this week. In the meantime, ask your host what protection they've put in place.
- Look for signs it's already happened: admin users you don't recognise, new or changed files you didn't make, odd redirects, spam being sent from your domain, or warnings from Google. If you see any of these, treat it as a cyber incident: don't just patch and carry on.
If you can't get the fix in quickly and the site handles customer data or payments, follow the NCSC's advice and consider taking it offline until it's done. A day offline costs far less than a breach.
The bigger lesson
Websites often slip through the cracks. They're built once, handed over, and nobody's quite sure who keeps the server updated. Keeping software updated is one of the five Cyber Essentials controls, and that includes the server your website runs on. If the answer to "who patches our website?" is a shrug, now's a good time to fix that.
Sources
- Help Net Security: PHP2Shell: critical PHP vulnerabilities patched, update now!
- Tenable: PHP2Shell frequently asked questions
- watchTowr: PHP2Shell, PHP remote code execution exploited
- Insurance Business: UK councils and Met Police among sites pulled offline after NCSC alert
- Ubuntu: PHP2Shell vulnerability fixes available
Not sure where your website stands?
I'll help you work out what your site runs on, who looks after it, and whether it's been patched. If you think it's already been attacked, it's a cyber incident and I can help with that too.