Website security rarely gives you much notice. Yesterday\u2019s PHP2Shell disclosure was a reminder of how quickly a problem behind the scenes can become a priority for businesses.<\/p>\n\n\n\n
On 21 October 2026, PHP released emergency security updates for two critical vulnerabilities. These flaws can allow someone to run malicious code on an affected server without logging in. Fixes are available, so the priority now is to establish whether your website is affected and confirm that the update has been applied. PHP security advisory<\/a><\/p>\n\n\n\n You don\u2019t need to become a server administrator overnight. You do need a clear answer from whoever looks after your hosting.<\/p>\n\n\n\n PHP2Shell is the name given to two vulnerabilities, tracked as CVE-2026-109618<\/strong> and CVE-2026-109619<\/strong>.<\/p>\n\n\n\n A coordinated disclosure had originally been planned for 22 October. After information leaked publicly, that timetable moved forward to 21 October, bringing the security response forward too. Both vulnerabilities have been rated critical, with severity scores of 9.2 out of 10. Ubuntu\u2019s disclosure update<\/a><\/p>\n\n\n\n Cloudflare has since confirmed that it observed attack traffic targeting its customers. There is a practical reason to act promptly: attempts to exploit the flaws are already happening. Cloudflare\u2019s response<\/a><\/p>\n\n\n\n That doesn\u2019t mean every affected website has been hacked. It means leaving an unpatched installation online carries a risk that needs addressing.<\/p>\n\n\n\n PHP is software running on your server. It powers platforms including WordPress, Drupal and Joomla, alongside bespoke websites and applications.<\/p>\n\n\n\n The vulnerabilities sit within PHP\u2019s handling of memory and failed requests. Researchers demonstrated attacks against several popular platforms, but those were examples of the wider problem. A website can be exposed even when its own application code is secure. Wiz\u2019s research<\/a><\/p>\n\n\n\n This distinction matters when deciding what to update.<\/p>\n\n\n\n Keeping your CMS, themes and plugins current remains good maintenance. However, those updates don\u2019t replace the PHP security fix. The underlying server software needs attention from your hosting provider, developer or infrastructure team.<\/p>\n\n\n\n Successful exploitation can allow an attacker to execute code with the permissions of the PHP process. That can give them access to files and services available to that process; it does not automatically mean unrestricted administrator access to the entire server. PHP\u2019s technical advisory<\/a><\/p>\n\n\n\n Researchers have also demonstrated access to sensitive information in memory, including passwords, tokens and API keys. Wiz\u2019s findings<\/a><\/p>\n\n\n\n For a business, the possible consequences include:<\/p>\n\n\n\n Those are possible outcomes, rather than evidence that they have happened to your site. The aim is to close the vulnerability and check whether anything needs investigating.<\/p>\n\n\n\n PHP has released fixes, and software distributors are providing updated packages. Some vendors apply the security changes to an older package without changing it to the latest upstream PHP version. This is known as a backported fix<\/em>. PHP\u2019s update guidance<\/a><\/p>\n\n\n\n Protection is also being added around affected systems. Cloudflare, for example, has deployed web application firewall protections and continues to adjust them as attack techniques change. It still advises customers to patch PHP. Cloudflare\u2019s protection update<\/a><\/p>\n\n\n\n For website owners, the job is to make sure those fixes have reached the systems their business actually uses.<\/p>\n\n\n\n Start with your main website, then check subdomains, staging sites, old installations and other PHP applications.<\/p>\n\n\n\n A forgotten development site still needs attention if it is publicly accessible. Products that bundle their own PHP installation may need a separate vendor update, too. NCSC-NL\u2019s recommended actions<\/a><\/p>\n\n\n\n Make a short list so each system has an owner and a confirmed status.<\/p>\n\n\n\n Ask whoever manages the server to confirm:<\/p>\n\n\n\n \u201cSecurity updates are automatic\u201d is useful background. You still need confirmation that these particular fixes are active.<\/p>\n\n\n\n The fixed upstream releases are:<\/p>\n\n\n\nWhat happened yesterday?<\/h3>\n\n\n\n
Why does this reach beyond one website platform?<\/h3>\n\n\n\n
What could happen if it\u2019s left unresolved?<\/h3>\n\n\n\n
\n
What\u2019s being done about it?<\/h3>\n\n\n\n
Eight checks to work through with your hosting team<\/h3>\n\n\n\n
1. Find every relevant website and application<\/h3>\n\n\n\n
2. Get a specific answer from your hosting provider<\/h3>\n\n\n\n
\n
3. Confirm the correct security update is installed<\/h3>\n\n\n\n