If you saw cybersecurity warnings leading the BBC News headlines today alongside reports of public services and major websites temporarily pulling themselves offline, you might have wondered why an underlying web technology was causing such a massive scramble.
The cause is PHP2Shell—a pair of critical security vulnerabilities discovered in PHP, the programming language powering roughly 70% of the web.
Whether you manage an e-commerce storefront, run a client website, or maintain a personal blog, here is what happened, why it matters, and the immediate steps you need to take.
What actually happened?
Emergency security advisories were published regarding two critical flaws (tracked as CVE-2026-109618 and CVE-2026-109619) affecting PHP core request handling.
In technical terms, the bugs involve memory corruption triggered by out-of-memory handling and stale state reuse across worker requests. In plain English: an unauthenticated attacker can send a specially crafted request over the web and execute malicious code directly on the underlying server. They do not need a password, an admin account, or physical access.
Because PHP operates behind Content Management Systems like WordPress, Drupal, Joomla, and frameworks like Laravel or Symfony, an attacker could potentially gain direct access to site databases, customer records, and file systems before application authentication even kicks in.
National agencies—including the UK’s National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA)—issued urgent warnings advising organizations to patch immediately or temporarily take affected systems offline until protected.
Are you affected?
If your website runs on PHP, yes. The issue touches nearly all web execution environments (including PHP-FPM, Apache mod_php, LiteSpeed, and FrankenPHP). This includes nearly every WordPress website.
The official security release addresses these flaws in the actively maintained branches:
- PHP 8.5 – Upgrade to 8.5.12 or newer
- PHP 8.4 – Upgrade to 8.4.27 or newer
- PHP 8.3 – Upgrade to 8.3.36 or newer
- PHP 8.2 – Upgrade to 8.2.35 or newer
Crucial Warning for Older Sites: If your server runs PHP 8.1, 8.0, 7.x, or 5.x, those versions reached official end-of-life long ago and will not receive direct upstream updates from the PHP Foundation. Sites on these legacy versions are dangerously exposed unless your Linux distribution or hosting provider backports an emergency patch.
Action Plan: What You Need to Do Immediately
- Audit Your Environment: Check which PHP version your website or server is executing. Most hosting control panels (cPanel, Plesk, Cloudways, RunCloud) display the active PHP version on your dashboard.
- Apply the Update:
- Managed Hosting: Check your host’s status page. Major managed hosts often patch the server runtime automatically, but you should verify your environment is running one of the patched releases listed above.
- Self-Managed Servers (VPS / Dedicated): Update your system packages immediately (e.g.,
apt update && apt upgradeordnf update) to pull the latest packages from your distribution’s security repository. Restart PHP-FPM and your web server once applied. - Legacy Environments: If you are running PHP 8.1 or older, use this moment as an urgent priority to upgrade your codebase to a supported version (PHP 8.2+).
- Engage Web Application Firewalls (WAF): Edge networks like Cloudflare have deployed initial mitigation rules to block known exploit vectors. While a WAF provides a vital safety buffer, it is not a substitute for patching the runtime.
- Check for Indicators of Compromise: If your server was publicly accessible before applying the patch, review web server error logs and process monitors to confirm no unauthorized shell sessions or backdoors were spawned.
Security researchers move fast, but automated threat actors move faster. Don’t wait until the weekend… patch your systems today.
