PHP2Shell: What Businesses Running PHP Should Know
Two critical PHP vulnerabilities affect the runtime itself, not just websites and plugins. Here is what they mean for your business, and five practical steps to take.
In October 2026, two critical vulnerabilities were disclosed in PHP, the programming language behind many business websites and web applications, WordPress among them. Known together as PHP2Shell, they are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 (Critical) under CVSS v4.0.
Under certain conditions, they can allow an attacker to run their own code on a web server, or read information from its memory, without needing to log in.
Why this one is different
Most website security updates concern a specific plugin or application. PHP2Shell sits in PHP itself. Keeping WordPress, plugins and themes up to date does not close the gap on its own: the version of PHP running on the server has to be updated too.
Security vendors have reported attempts to exploit the flaws. As of late October 2026, no widespread compromise had been confirmed. That makes this the right time to act calmly and methodically, rather than wait.
Is your business affected?
If your business runs a website, customer portal or internal tool built on PHP, treat it as in scope until someone confirms otherwise. Many businesses do not know which PHP version their hosting provider runs. That is the first thing to find out.
- Supported versions have fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later.
- PHP 8.1 and older are past end of life and do not receive official fixes. Some hosting providers have applied their own patches, so ask yours directly.
Five priorities for business and IT teams
- Know where PHP runs. List every website and application that uses it, including those managed by your web agency or hosting provider.
- Update to a fixed release. Confirm the version, apply the update, and restart PHP services afterward so the fix takes effect.
- Plan for older systems. If anything runs PHP 8.1 or older, confirm whether a provider patch is in place, limit who can reach it, and schedule its replacement.
- Review activity. Check logs and security alerts on internet-facing servers for anything unusual.
- Confirm recovery. Make sure backups are current and that the site could be restored if needed.
The bigger lesson: cybersecurity starts with visibility
PHP2Shell is a reminder that you can only protect what you know you have. Businesses that know which systems they rely on, who maintains them and how they are kept up to date can respond to a disclosure like this quickly and with confidence.
Security should create confidence, not more noise.
If you are not sure how PHP2Shell affects your environment, we can help you find out.
This article expands on our LinkedIn post of October 30, 2026.
Sources: Guardz, Defending Against PHP2SHELL Attacks; Tanium, PHP2Shell: Responding to CVE-2026-109618 and CVE-2026-109619.