Is Your Website Safe? What the Latest PHP Security Flaw Means for Your Business
Table of Contents
TL;DR:
If your website runs on PHP, it may be exposed to a critical security flaw, and the fix is a PHP security update that your web host or developer must apply to the server.
Two serious PHP vulnerabilities, nicknamed PHP2Shell, were announced on October 20, 2026, and PHP released emergency patches on October 21. The U.S. cybersecurity agency CISA urged organizations to patch immediately.
The PHP Vulnerability at a Glance
| Question | Answer |
| What is it called? | PHP2Shell: two flaws tracked as CVE-2026-109618 and CVE-2026-109619 |
| How serious is it? | Critical, rated 9.2 out of 10 by PHP’s security team |
| What could an attacker do? | Run their own commands on a web server, without needing a password |
| Is it being exploited? | Yes. Amazon, Cloudflare and watchTowr have reported real attack attempts |
| What is the fix? | Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the version your host’s vendor supplies), then restart PHP |
| Does updating WordPress fix it? | No. The flaw is in PHP itself, so the server must be updated |
Sources: Tenable, Help Net Security, Codeable.
What is PHP?
PHP (PHP: Hypertext Preprocessor) is a programming language that runs on a web server and builds your web pages each time a visitor arrives. Think of it as the engine under the hood: you never see it, but your contact forms, online store, booking tools and blog all rely on it.
It is everywhere. PHP is used by about 69% of websites whose server-side language is known, and platforms such as WordPress, Drupal, Joomla and Magento run on it (Tenable). That is why a flaw in PHP itself, rather than in one plugin or one website, affects so many businesses at once.
The PHP Security Vulnerability Timeline
In simple terms, the first flaw (CVE-2026-109618) involves PHP mishandling a request when the server runs low on memory, and the second (CVE-2026-109619) lets leftover data from one visitor’s request be reused by a later one. Either can be abused to take control of the server.
- October 17: Amazon’s threat team logged an attack attempt against its decoy servers, four days before the public announcement.
- October 20: The flaw identifiers leaked online, and PHP announced a release for the next day. Security firm Qualys published its report the same day.
- October 21: PHP released the patches, and CISA issued its alert.
- Since then: Cloudflare and watchTowr report seeing attacks, and exploit code is circulating online, though it is unverified. Researchers have also shown that the flaws can be used to expose stored passwords, login tokens and API keys (Qualys).
Is Your Website at Risk?
Your site is potentially at risk if it runs on PHP and the server has not yet been updated. Sites on very old PHP are the most exposed: Qualys found about 167 million PHP installations worldwide, and roughly 71% of those with a known version run end-of-life PHP (8.1 and older) that no longer gets regular fixes (Qualys).
Being at risk does not mean your site has been hacked. But if an attacker did take over a web server, the damage could include:
- Stolen customer data, such as form entries, orders and logins, with possible legal and reputation costs.
- A defaced or offline website, meaning lost sales and lost trust while you recover.
- Hidden malware or spam pages that can get your site flagged by Google or blocked by browsers.
- A foothold for attacks on your customers or on other sites on the same server.
Potential Actions to Take
Who does the fixing depends on how your site is hosted. If a company manages your hosting, the PHP security update is their job, and yours is to confirm it is done.
Ask them:
- Has the October 21 PHP security update been applied to the server my site runs on? Ask for a yes or no, and a date.
- Which PHP version does my site run? The check must cover the server that actually serves your website. If the answer is 8.1 or older, ask for an upgrade plan.
- Has PHP been restarted since the update? Without a restart, the vulnerable code can stay in memory.
- Who checks my site’s health, and how often? One patch is not enough. Updates should be routine, not an emergency.
- Do I have a recent backup? A clean backup is your fastest way back if something goes wrong.
A note on version numbers: some hosts and Linux providers apply the fix without changing the visible version number, so an older-looking number may still be patched. Ask your host rather than guessing (Codeable).
If you run your own server and cannot update right away, security agencies such as the UK’s NCSC suggest taking the site offline until it is patched. A web firewall such as Cloudflare’s adds a layer of protection, but it is a stopgap, not a replacement for the update.
Which PHP Versions are Fixed?
PHP branch | Status |
8.5 | Fixed in 8.5.12 |
8.4 | Fixed in 8.4.27 |
8.3 | Fixed in 8.3.36 |
8.2 | Fixed in 8.2.35 |
7.4 to 8.1 | No official release; minimal source backports only, so use a vendor-patched build or upgrade |
5.4 to 7.3 | End-of-life; no fix from PHP |
PHP considers servers running Apache with mod_php the highest risk, but all web-serving setups are affected, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. If patching must wait, PHP lists temporary settings that reduce exposure, such as disabling session.upload_progress.enabled and restarting PHP workers. These do not make a server safe; updating is the only full fix (Tenable).
What is PHP2Shell?
It is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that could let an attacker run code on a web server without logging in.
Is the PHP vulnerability being exploited?
Yes. Amazon, Cloudflare and watchTowr have all reported attack activity.
Will updating WordPress or my plugins fix it?
No. The flaw is in PHP itself, and WordPress.org has said no WordPress update is planned or needed. The server's PHP must be updated.
I'm on managed hosting. Do I need to do anything?
Usually the host patches PHP, but confirm it in writing and ask whether PHP was restarted.
My site runs an old PHP version. Is it safe?
Not unless your host has applied its own fix. PHP 8.1 and older no longer get regular updates, so plan an upgrade, and test first because older themes and plugins can break.
How do I check my PHP version?
In WordPress, go to Tools, then Site Health, then Info, then Server. Your hosting control panel also shows it, but your host can confirm what the live site is actually running.
The Bottom Line
The PHP2Shell vulnerability is serious, but it is fixable, and the fix is simple when someone is paying attention. The lasting lesson for any business with a website is that security is not a one-time project. It is steady maintenance, done on time, every time.
If your website is hosted with FreshMove Media, you can relax: your site is secure.
PHP has been updated for every site on our server, and a real human (who also wrote this article!) manually checks site health every week and makes sure all routine updates are performed, so if more patches arrive in the near future, we’ll already be on it.
Have questions about your site’s health? Just reach out to us at FreshMove Media.