PHP2Shell: what it means for your website, and what to do now

If your website runs on PHP, you need to update it. Today.

On Wednesday 21 October, security researchers disclosed PHP2Shell, a set of critical flaws in PHP itself. PHP is the programming language behind around 70% of websites, including anything built on WordPress, Drupal, Joomla, Moodle, Nextcloud or Laravel. So, there's a good chance it's running somewhere in your business, even if you've never heard of it.

The good news? There's a fix, and it's straightforward. Here's what you need to know.

What is PHP2Shell?

PHP2Shell is the name for two related security flaws in the core of PHP. They're tracked as CVE-2026-109618 and CVE-2026-109619 (CVEs are the official reference numbers given to known vulnerabilities). Both score 9.2 out of 10 on the industry's severity scale, which puts them firmly in the critical category.

What makes them unusual is where they live. The problem isn't in your website's code or your plugins. It's in PHP, the engine underneath. That means a perfectly well-built, fully updated website can still be at risk if the server it runs on hasn't been patched.

What could an attacker do?

The researchers showed they could take over WordPress, Drupal and Joomla sites without ever logging in. On an unpatched server, an attacker could:

• run their own code and take control of the server
• read passwords, login tokens, API keys and certificates straight from the server's memory
• quietly steal that data without installing anything, which makes the attack much harder to spot

From there, they could deface your website, access sensitive data or use the server as a way into the rest of your network.

Are you affected?

Probably, unless you've updated PHP in the last day or so. The flaws go all the way back to PHP 5.4, and nearly every version released before this week's fix is affected by at least one of them.

Don't forget the less obvious places PHP might be running: intranets, learning platforms, file-sharing tools, customer portals and any custom apps your developers have built.

What to do now

Upgrading PHP is the only complete fix. Make sure every server is running at least the version below for its branch.

Once you've upgraded, restart your web server and any PHP services so the new version actually takes effect.

One thing that catches people out: updating WordPress, Drupal or your plugins doesn't update PHP. They're separate, so check both. If you're on an older branch, such as PHP 7 or earlier, now's the time to plan a move to a supported version.

Can't upgrade straight away?

Some firewall and hosting providers have released temporary protections, and there are configuration changes that can close off some attack routes. They're worth using while you prepare, but they don't cover every variant of the attack. Treat them as a stopgap, not a solution, and get the upgrade done as soon as you can.

Need a hand?

Finding every PHP server across your business isn't always easy, especially when sites and apps have been built up over years. That's where we come in.

We'll find out which versions you're running, patch and restart everything safely, and check your setup is hardened for the future. If you can't upgrade straight away, we'll put temporary protections in place to keep you covered in the meantime.

Get in touch with our team at enquiries@itps.co.uk or call us. We're happy to help, whatever the size of your estate.