Your website probably runs PHP. Get it patched today.

· · Security Infrastructure

If your business has a website, a customer portal, or an intranet, there is a good chance it runs on PHP. So do WordPress, Drupal, Joomla, Magento, most shared hosting, and the control panels that manage it. As of this week, every one of those needs a software update, and the people looking after your site need to apply it today rather than at the next scheduled maintenance.

On 21 October the PHP project released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both let an attacker who has never logged in run their own code on the web server. The NCSC has told UK organisations to update immediately, and to consider taking systems offline if they can't.

What happened

The flaws sit in how PHP cleans up after a request goes wrong, for example when it runs out of memory partway through. Under the right conditions, a crafted web request can corrupt the server's memory and take control of it. Both are rated 9.2 out of 10 for severity.

This is not a bug in your website's code or a plugin. It is in PHP itself, the engine underneath. Wiz, one of the teams that found it, showed working attacks against out-of-the-box WordPress, Drupal, and Joomla, and noted that even a one-line "Hello World" page on an affected version can be vulnerable. The same flaws can also leak memory from the server, which may hold passwords, login tokens, and API keys.

Details were due out on 22 October, but the CVE numbers leaked online two days early and PHP brought the release forward. Cloudflare reported attack traffic against its customers within hours, and watchTowr told The Record it was already seeing exploit attempts, none successful yet. Several European governments, the Dutch parliament, and privacy group noyb took websites offline as a precaution.

Updating WordPress is not enough

Because the flaw is in PHP, updating WordPress or its plugins does not fix it. Someone has to update the PHP software on the server. On shared or managed hosting that someone is your host. If an agency built and runs your site, it is probably them.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer get fixes from the PHP project, although some Linux distributions and paid support vendors are backporting them. A researcher at Detectify estimates that roughly half of PHP websites run one of those older versions.

PHP also hides in places nobody thinks of as "the website": hosting control panels, old marketing microsites, booking systems, network storage boxes, and other appliances with a web admin page. The Dutch NCSC keeps a list of products with a PHP dependency that is worth checking against what you own.

What to do today

If someone else hosts your website, send them three questions:

  • Is our site running on PHP, and which version?
  • Have you applied the PHP2Shell fix (8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a vendor backport)? When?
  • If we are on PHP 8.1 or older, what is the plan, and what protects us in the meantime?

A good host will answer all three today. Vague reassurance is not an answer.

If you run your own servers, find every PHP installation, starting with anything reachable from the internet, and update it from your distribution's packages or from php.net. Restart PHP afterwards. Packages are still landing on some platforms: AWS says Amazon Linux updates are due on 22 October, and Lightsail instances can't be updated in place, so they need rebuilding from new images.

If you can't patch today, the PHP advisory lists configuration changes that reduce exposure without fully closing it. A web application firewall, a filter in front of your site that blocks known attack patterns, also helps. Cloudflare's free plan now blocks these attacks by default. Neither replaces the update. If you can do none of that, follow the NCSC's advice and take the system offline until you can.

Once patched, check whether anything got in first. Look for unfamiliar files in the web folders, new admin accounts, and PHP processes launching programs they never normally would. A server that was exposed for days before patching deserves a proper look.

How Steelwise can help

If you don't know where your PHP is running, who is responsible for updating it, or whether your host's answer holds up, that's exactly what a quick security review sorts out. Get in touch and we'll help you work through it today.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.