On October 21, the team behind PHP released emergency fixes for two critical security flaws, nicknamed "PHP2Shell." PHP is the programming language behind a large share of the world's websites, including every WordPress site. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging everyone who runs PHP to patch immediately.
What the problem is
The two flaws (CVE-2026-109618 and CVE-2026-109619) are rated critical, 9.2 out of 10. In the worst case, an attacker on the internet could send a specially crafted request to a website and run their own commands on the server behind it, with no password needed. From there they could deface the site, steal data, plant malware, or use the server to attack others.
The flaws reach back roughly a decade of PHP versions, and they affect the common ways PHP runs on a web server. Security researchers expect attackers to move quickly, so this is not one to leave for later.
Is this you?
You are likely affected if your business has any of these:
- A WordPress website, or another site built on PHP software such as Joomla or Drupal.
- An online store, customer portal or booking system built on PHP.
- Web software on a server in your office, such as an intranet, a ticketing system or a line-of-business app with a web interface.
If you aren't sure what your website runs on, that is worth a quick check. Sites hosted on platforms like Wix, Squarespace or Shopify are managed by those companies and you don't need to do anything.
Who has to fix it
The fix is an update to PHP itself, not to your website. That matters, because updating WordPress or its plugins does not fix this. Whoever runs the server has to install the new version of PHP and restart it.
- If your website is with a hosting company, the host is responsible. Many large hosts are patching their servers already. It is still worth asking yours to confirm.
- If you run your own server, in your office or in the cloud, PHP needs to be updated to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later), depending on which version you use.
- If your server runs PHP 8.1 or older, there is no official update. That is a sign the server is overdue for an upgrade, and in the meantime it needs extra protective settings or should be taken off the internet.
A simple plan
- Make a list of every website and web-based system your business uses.
- Find out where each one is hosted and who manages it.
- Ask your web host or web developer to confirm PHP has been patched, and get the version number in writing.
- Patch any servers you manage yourself, today if possible.
- Keep an eye out for anything odd on your sites, such as new admin users, changed pages or unexpected files.
How we can help
We can check which of your websites and systems run PHP, contact your host or developer on your behalf, and patch or protect servers we manage. Contact us or call (480) 382-3289 to get started.
Source: Critical Vulnerabilities in PHP Require Immediate Patching (CISA)