Is your website at risk? What you need to know about PHP2Shell

On Wednesday 21st October, PHP released an emergency fix for two critical security flaws after news of them leaked online ahead of schedule. PHP is the coding language that most websites are built on, WordPress included, so this was a major global issue. If you spotted sites going offline or into maintenance mode around the same time, that’s why. Plenty of organisations took their sites down temporarily rather leaving them at risk of being exposed while they were patched. 

It’s a bit technical, but bear with us. We’ll walk through what happened and what it means for your website, including how we’ve kept our clients protected, and the steps that you can take to keep your site safe.

What happened with PHP?

Back in August, security researchers at Calif and Wiz discovered two serious flaws on PHP using OpenAI. On 24th August, they privately reported them to the PHP security team, initiating what is known as a ‘coordinated disclosure’. In simple terms, the people who find the problem keep it under wraps while a fix is built, so that everyone can patch before attackers get wind of it. The plan was to go public with a fix on Thursday 22nd October. 

That plan came unstuck on Tuesday 20th October, when an anonymous user posted on the forum Hacker News that two major PHP flaws were about to be announced. The post didn’t explain how the flaws worked, but it was enough to tell the world, attackers included, that something big was on its way. It was taken down fairly quickly, though not before screenshots had started to circulate on social media.

PHP bought the release forward by a day, and the fixes landed on Wednesday 21st October. 

The flaws are officially tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both vulnerabilities sit firmly in the critical category.

The reason website hosts were so on edge is that the flaws allow something called remote code execution (RCE). This meant that an attacker could apply their own code on a website’s server without needing to log in, which could lead to stolen data or a full takeover of the site. 

That made rolling out the patch a top priority for anyone running a website on PHP.

What does this mean for my website and how do I make sure it’s protected?

PHP is used by nearly 70% of websites whose server-side language is known. Chances are your website runs on it, even if it’s quietly working away in the background.

Putting it straight, if you haven’t already, get in touch with your website host or website provider as soon as you can and ask them to confirm your site has been updated. Until it is, your site is open to attack. Plenty of hosts acted quickly, so there may be nothing you need to do, but it’s worth confirming things with them.

What happens next depends on which version of PHP your site runs on. 

PHP released the security patch at around 2:30pm on 21st October, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site runs on PHP 8.2 or newer, it’s a case of applying the patch, which is usually a straightforward job for your host.

If your site is running from an older version of PHP, the fix won’t be coming. Upgrading to a supported solution is the best solution, and it’s a bigger job, as old themes and plugins aren’t always compatible with newer versions of PHP and need checking first. 

If the update can’t happen straight away, the National Cyber Security Centre recommends taking your site offline until it is. Either way, your host is the best place to start and if you’re not sure where to turn, we’re happy to lend a hand. 

How AI is changing the game for web security

The key part of this story is that the flaws weren’t new – they’d been sitting unnoticed for years.  

What changed is how they were found. Calif and Wiz uncovered them with help from OpenAI. There are some mixed opinions about this discovery, with some arguing that the clues were under public scrutiny. Either way, it shows that AI is starting to play a part in finding these flaws. 

The downside is that these tools are indiscriminate. While AI can help researchers spot a weakness, it can help hackers to do the same. 

This has been on the cards for a while. Back in May, the National Cyber Security Centre warned that AI would bring a ‘vulnerability patch wave’ with old flaws being uncovered faster than ever and businesses needing to patch quickly and often to keep up. The events of the last few days look to be that warning playing out. 

“Over the past 18 months we have seen a huge increase in attacks on our servers. The reality is AI can compute huge calculations at speeds a human hacker could previously only dream of.

The lack of regulation around AI has opened a door to something the web isn’t ready for, and governments are now finding themselves scrambling to get things under control. There are tools and processes that can actively serve to minimise these threats, but they all come at a cost, and it is these costs that small to medium sized businesses are keen to avoid at this moment in time.” Ian Howes, Founder and Creative Director, Nu Image

Why WordPress maintenance matters

In the studio, our development team specialises in WordPress websites, and has been running on caffeine over the last couple of days making sure our clients’ sites are protected.

For clients on our WordPress security package, the job was a lot more straightforward, as their sites are updated every quarter. Their sites were already in good shape when this landed, meaning we could just apply the patch. 

A site that’s been left alone for years is more likely to be an older version of PHP, with themes and plugins that need checking before it can be updated, and that’s a much bigger job to tackle under pressure. 

With the NCSC expecting more flaws like this to come to light, updates are becoming a non-negotiable part of running a website. Some situations will always come out of the blue, but keeping on top of them little and often makes those moments slightly easier to manage when they come around.

Need a hand?

If you’re not sure where your website stands, we’re happy to take a look. We’ll work on WordPress sites even if we don’t host them, so if you need help applying the patch, upgrading an older site, or getting set up with regular maintenance, get in touch and we’ll help you figure it out. 

Give us a call on 01603 859007.