A newly disclosed security issue affecting PHP has put website security back in the spotlight. Known as PHP2Shell, the issue involves two critical vulnerabilities that could allow attackers to execute code remotely on affected servers without first logging in.
The vulnerabilities were publicly disclosed on 21 October 2026, and the PHP project has released security updates to address them. Organisations running PHP-powered websites and applications should check whether their hosting environments are affected and ensure the appropriate updates are applied.
For businesses that depend on their websites, online services, or customer-facing applications, this is an important reminder that website security involves more than keeping the website content and plugins up to date.
What Is the PHP2Shell Vulnerability?
PHP is a widely used server-side programming language that powers many websites and web applications. It is commonly used by content management systems, online stores, and custom business applications.
PHP2Shell is the name associated with two critical vulnerabilities in the PHP runtime itself:
- CVE-2026-109618: A flaw involving memory handling during an out-of-memory condition.
- CVE-2026-109619: A flaw involving stale internal state that can persist between requests.
Under affected conditions, these flaws can allow an unauthenticated attacker to execute code with the privileges of the PHP worker process. Depending on the server configuration and permissions, this could put website files, application data, and other accessible resources at risk.
Both vulnerabilities have been rated critical, with a CVSS v4.0 score of 9.2. The actual impact on an individual system depends on its PHP version, configuration, and deployment.
Why Should Businesses Take This Seriously?
A compromised website can create problems well beyond a temporary outage. If an attacker gains control of a vulnerable PHP process, they may be able to interfere with the application, access information available to that process, or attempt to establish further access.
Potential consequences may include:
- Unauthorised access to website files or application data
- Website defacement or malicious changes to website content
- Exposure of sensitive information accessible to the application
- Malicious code being added to a website
- Disruption to website availability and business operations
- Further compromise of systems accessible from the affected server
These are potential consequences, not proof that every vulnerable website has been compromised. However, businesses should not assume that a website is safe simply because it still appears to be functioning normally.
Which Websites and Systems May Be Affected?
The vulnerabilities affect PHP runtimes, rather than one particular website platform. Systems using affected PHP versions may be at risk if they process web requests.
This means businesses should consider checking:
- WordPress websites and other PHP-based content management systems
- Online stores and e-commerce applications built with PHP
- Custom PHP business applications
- PHP-powered portals and customer-facing services
- Servers running PHP through Apache, PHP-FPM, or CGI
- Hosting environments and appliances that bundle their own PHP runtime
Using WordPress or another PHP-based platform does not automatically mean a website has been compromised. The important question is whether the underlying PHP runtime is affected and whether the required security update has been applied.
Updating a website's theme or plugins alone will not necessarily fix a vulnerability in the PHP runtime.
Which PHP Versions Need Attention?
The PHP project has released security updates for supported branches. The following releases include fixes for PHP2Shell:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
These are the specific patched releases announced on 21 October 2026. Administrators should use the latest appropriate security update available for their supported branch, rather than treating these version numbers as the latest available forever.
PHP 8.1 and older branches require special attention because they are no longer supported by the PHP project. Some operating system vendors may provide backported security fixes, so administrators should verify the status of their specific vendor package.
If a system cannot receive a supported security fix, a migration to a supported PHP version should be planned urgently.
7 Steps Businesses Should Take Now
1. Identify Where PHP Is Running
Start by identifying websites, servers, applications, and hosting services that use PHP. Do not check only the main website. Older applications, staging sites, subdomains, and bundled runtimes may also need attention.
2. Confirm the PHP Version
Ask your hosting provider or server administrator to confirm the PHP version actually serving requests. A version displayed in a local development tool may not match the production environment.
3. Apply the Appropriate Security Update
Upgrade affected installations to a patched release or apply the appropriate security update supplied by your operating system or hosting vendor. Confirm that the running PHP service is using the updated runtime.
4. Restart and Verify the Relevant Services
Depending on the deployment, PHP workers or web services may need to be restarted for the patched runtime to take effect. Have the administrator verify the active version and test the website after the change.
5. Contact Your Hosting Provider If You Do Not Manage the Server
Many businesses use managed hosting and do not have direct access to the underlying PHP environment. Contact the hosting provider and ask whether the PHP2Shell security fixes have been applied to every relevant runtime.
Request confirmation rather than assuming that routine hosting maintenance has already addressed the issue.
6. Review Logs and Investigate Suspicious Activity
If your website was running a vulnerable PHP version while exposed to the internet, review available web server, PHP, and security logs for suspicious activity. Investigate unexpected file changes, unusual application behaviour, and unexplained processes or account changes.
Patching closes the vulnerability, but it does not automatically remove malicious changes that may already have occurred. If compromise is suspected, preserve relevant logs and seek professional incident-response assistance.
7. Review Backups and Recovery Readiness
Ensure that recent backups are available, protected, and capable of being restored. If malicious activity is discovered, avoid blindly restoring a potentially compromised backup without investigating the incident first.
A tested recovery plan can help reduce downtime if the website or server needs to be rebuilt.
Can a Firewall or Security Plugin Protect Your Website?
Firewalls, web application firewalls, endpoint protection, and monitoring tools can provide valuable layers of defence. Depending on the product and configuration, they may block some malicious requests or help identify suspicious activity.
However, these controls should not be treated as a replacement for the official PHP security updates. The appropriate patch is the primary remediation for an affected runtime.
If an update cannot be applied immediately, administrators should follow the relevant vendor's mitigation guidance and assess whether the exposed service should be temporarily taken offline until it can be secured.
What If Your Website Is Hosted by a Third Party?
If another company manages your website or hosting, you may not know which PHP version is running behind the scenes. This is particularly common with managed WordPress hosting and shared hosting plans.
Contact your provider and ask them to confirm:
- Whether your website's PHP runtime was affected
- Whether the relevant security update has been applied
- Whether all production and staging environments are covered
- Whether any additional action is required from your business
- Whether suspicious activity needs to be investigated
Keep the provider's response with your website maintenance records so you have a clear record of the remediation.
How Imatec Can Help
At Imatec, we understand that businesses rely on secure and reliable technology to support their daily operations. A vulnerability such as PHP2Shell is a reminder of the importance of keeping systems updated and understanding which services are exposed to the internet.
Our IT support team can help businesses review their IT environment, coordinate with relevant hosting or technology providers, and identify practical steps to improve security and reduce risk.
If you manage your own website or server, ensure that the responsible administrator checks the official PHP advisories and applies the correct updates. If your website is managed externally, contact your provider to confirm its status.
Do Not Wait to Check Your Website Security
PHP2Shell highlights how a vulnerability in a widely used software component can affect many different websites and applications. Keeping your website content updated is important, but maintaining the underlying server software is just as essential.
Identify your PHP installations, verify the running versions, apply the appropriate security updates, and investigate any signs of compromise.
For official technical information, refer to the PHP security advisories and the UK National Cyber Security Centre's PHP2Shell guidance.
If your business needs help reviewing its IT security or coordinating with its website provider, contact the Imatec team.
Matamata: 07 888 5627
Tauranga: 07 985 6255
Email: support@imatec.co.nz
Imatec — Your local IT experts in Matamata, Tauranga, Waikato, and the Bay of Plenty.