In October, the PHP developers released urgent fixes for PHP2Shell, a pair of serious security flaws in PHP. PHP is the programming language behind most websites, including WordPress, WooCommerce and many online shops, so this is one of the more important security updates of recent years.
If you are not sure whether your website has been updated, you are not alone. The good news is that it is quick to check and, in most cases, quick to fix.
What PHP2Shell is
PHP2Shell is the name given to two flaws, CVE-2026-109618 and CVE-2026-109619, published on 21 October 2026. Both are rated critical. On an unpatched server they can let an attacker run their own commands, which in practice means taking control of the website and anything else on that server.
The flaws affect PHP from version 5.4 right up to 8.5. Reports of attacks began around the time the fixes were released, and an estimated 70% of websites run on PHP, so there is no shortage of targets.
Is your website affected?
Your site is likely to be at risk if any of these apply:
- It has not had its PHP version updated since 21 October
- It runs PHP 8.1 or older, which no longer receives official updates
- You are not sure who looks after the server, or nobody has mentioned PHP2Shell to you
- It was built some years ago and has not been looked at since
The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions 7.4, 8.0 and 8.1 only received patches that a hosting company has to apply itself, so sites on those versions depend entirely on their host having done the work.
What needs doing
The PHP developers were clear that updating is the only safe option. Temporary workarounds are not a complete fix.
For most websites, that means moving to a patched PHP version, then testing the site to make sure nothing has broken along the way. Older sites may need some code updating first, because a jump of several PHP versions can stop plugins or custom features working. The UK's National Cyber Security Centre has also advised checking servers for signs that someone got in before the patches were applied.
Let us deal with it
If you have any doubt about your website, get in touch. We will check which PHP version your site is running, update it to a patched release, test the important pages and forms afterwards, and tell you plainly what we found.
We do this work regularly for the sites we host and support, so it is usually quick and causes little or no disruption to your visitors. If your site needs more work to run on a current version of PHP, we will explain what is involved before we do anything.
There is no need to wait and see. A short check now is far easier than recovering a website after an attack.
