On 21 October 2026, parts of the internet went quiet. Government websites in France, Denmark, Finland, and the Netherlands went offline. Japan's Prime Minister urged companies to check whether their websites use PHP and to patch.
It was not an outage. It was the start of a race.
PHP, the language behind roughly 70 percent of websites with a known server-side language, had just disclosed two critical flaws now known as PHP2Shell. Site owners are now racing to patch, and attackers to reach the sites that have not.
If your website or customer data runs on PHP, you are in that race.
PHP2Shell at a glance
- What: two critical flaws in PHP itself, rated 9.2 out of 10 by PHP.
- Who: PHP sites not updated since 21 October, including WordPress, Drupal, Magento, and custom PHP applications.
- Fixed in: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
- No official fix: PHP 8.1 and older.
- Status: exploitation is under way, and a third related flaw still awaits a fix.
- Do now: update or upgrade PHP, restart it, then test your site.
What PHP2Shell actually is
PHP2Shell is the name for two vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both involve PHP mishandling memory. Exploited, they can let an attacker run their own code on your server without logging in, and expose data held in memory. That can mean a hijacked site, stolen customer data, or both.
The flaws sat in PHP's code for over a decade before researchers at Calif and Wiz found them with help from frontier AI models. Amazon recorded an exploitation attempt four days before the flaws were made public, and the US cybersecurity agency CISA has since listed CVE-2026-109618 as a known exploited vulnerability.
Is your website in the race?
WordPress, Drupal, Magento (Adobe Commerce), and Joomla sites all run on PHP, as do custom PHP applications built on frameworks like Laravel, CakePHP, and CodeIgniter. Researchers have shown working attacks on several of these. Here is how this PHP vulnerability affects each PHP version:
- PHP 8.2 to 8.5: patched. Update to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or later. PHP 8.2 loses support on 31 December 2026.
- PHP 7.4 to 8.1: end of life. No official release, only backports and some hosting-provider builds.
- PHP 7.3 and older: end of life, with no fix from PHP at all.
Security firm Qualys counted only around 199,000 patched installations in the first 12 hours, out of roughly 156 million.
What to do this week
If you or your developers manage the server:
- Find the PHP version serving your site. On WordPress, check your WordPress PHP version under Tools > Site Health > Info > Server. Otherwise, ask your host. Ubuntu, Debian, and Red Hat packages use their own version numbers, so check your distribution's security notice instead.
- Apply the PHP security update, or plan an upgrade if you are on 8.1 or older.
- Restart PHP-FPM or your web server. New packages do not patch processes that are already running. Containers need a rebuild and redeploy.
- Update your CMS, plugins, extensions, and framework dependencies to match. A WordPress update does not update PHP.
- If you cannot update today, use the workarounds in PHP's security advisory or a web application firewall as a stopgap. Only updating fully fixes it.
- Review your logs and rotate credentials if anything looks unusual.
If a host or agency manages your site, ask them to confirm your PHP version, the update, a restart, and testing since. Unclear answers mean it is time for a second opinion.
Not sure where you stand? We will audit your PHP code and fix whatever leaves your site exposed.
Still on PHP 8.1 or older? Why an upgrade can't wait
If your site has stayed on old PHP because "it still works," that stops being true now. Qualys found that about 71 percent of the PHP installations it could identify run end-of-life versions, most of which will never get a vendor patch. Stopgaps only buy time.
An upgrade means testing your CMS, plugins, and custom code on a staging copy first. Done properly, it closes PHP2Shell and the next flaw in one move.
Patching is the start, not the finish line
Updating closes the door. It does not tell you whether anything walked through it, or what the update broke.
- Updates can break things. PHP's 8.4.27 and 8.5.12 releases have a known bug that can crash some applications using SimpleXML.
- AI will keep finding more. Wiz said one researcher finished in a week what once took a world-class team months. A once-a-year security check is no longer enough.
The firms that come through events like this calmly are not the ones that react fastest. They are the ones that already test continuously.
How we can help
Since 2006, Evon has grown into a 425+ person team, CMMI Level 5 appraised and ISO 27001:2022 certified. We build and maintain WordPress, Drupal, and Magento sites, plus custom PHP applications on Laravel, CakePHP, and CodeIgniter.
Our PHP2Shell Exposure Check audits your code and stack, then shows you exactly what to fix:
- Version audit: the PHP version serving your site, and everywhere PHP runs in your stack.
- Patch plan: whether you need a patch or a full upgrade, and the effort involved.
- Test report: security testing by PAL, our independent testing practice, including human-led penetration testing against the OWASP Top 10.
Our WordPress, Drupal, Magento, and PHP development teams update PHP and your platform together, and PAL runs regression testing to confirm nothing broke. It all comes as an affordable, fixed-price package.
The race started on 21 October. It is not too late to finish it well. Book your PHP2Shell Exposure Check, and know exactly where your site stands.
