PHP2Shell: When the Problem Isn't Your Website

PHP2Shell: what happens when the code you never touched lets attackers in?

That's the question PHP2Shell is forcing a lot of organisations to ask this week.

On 21 October 2026, the PHP project released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Together they've been named PHP2Shell.

Both are rated 9.2 on CVSS v4. Both let an unauthenticated attacker run code on a web server.

No login. No vulnerable plugin. No mistake in your own code.

Just a PHP version that hasn't been updated.

What Is the PHP2Shell Vulnerability?

PHP is the engine behind a large share of the web, including most WordPress, Drupal and Joomla sites. The two flaws are inside that engine, not in the website built on top of it.

In plain terms, attackers found a way to confuse PHP at the very moment it starts handling a visitor's request. Send the right request, and they can take control of the server. No password required.

That means a website can be fully up to date, every plugin patched, and still be exposed. The risk sits with whoever manages the server, not whoever manages the content.

Almost every version of PHP from the last decade is affected. Older sites on shared hosting are the most exposed.

The consequences go well beyond a defaced homepage. Researchers showed attackers could quietly read passwords, customer sessions and access keys straight from the server. For any organisation handling personal data, that is a GDPR conversation, not just an IT one.

Why Updating Your CMS Won't Fix It

Most website owners are used to a familiar rhythm: a plugin has a flaw, the plugin gets an update, you apply it.

PHP2Shell breaks that rhythm.

Updating WordPress or Drupal does nothing here. The fix has to be applied to PHP by whoever controls the server, the container image or the hosting plan. A site with zero plugins, kept perfectly up to date, is still exposed if the runtime underneath it is old.

And the disclosure didn't go to plan. Details leaked a day early, a working attack was posted online by mistake, and attempts to exploit it began within hours. Some organisations, including Dutch government services, took systems offline as a precaution.

If you can't name the person responsible for patching PHP on your site, it's worth assuming it hasn't been done.

Is Your Website Exposed? Four Questions to Ask This Week

You don't need the technical detail to get a clear answer. Ask whoever looks after your websites:

1. Has PHP been updated on every site we run, including older microsites and test environments?
2. Who is responsible for patching it, and how quickly did they act?
3. Are any of our sites on PHP versions that no longer receive security updates?
4. Has anyone checked whether we were compromised before the fix was applied?

If the answer to any of these is "we're not sure", that is the answer.

The Hidden Cost of Running a PHP CMS

PHP2Shell will be patched across most of the web within weeks. The more useful question is why so many organisations couldn't patch within hours.

In our experience, the answer is usually ownership. The agency built the theme, a developer added the plugins, a hosting company runs PHP, and the client carries the risk. When something breaks at the runtime level, everyone assumes someone else is handling it.

Add to that the number of sites still running end-of-life PHP because a plugin won't work on anything newer, and the weekly stream of plugin vulnerabilities that never make headlines, and the real cost of a PHP CMS becomes clearer. It isn't the licence. It's the recurring emergency.

Protecting Your Website: Managed Care or Migration

For some organisations, the right answer is to keep the platform and hand its care to a team that owns it. ArekiboCare is our dedicated website and digital platform management service. Hosting, monitoring, security, patching and vendor coordination, all under one fixed-price SLA delivered 24/7/365. When the next PHP2Shell lands, someone is already on it. Less firefighting. More confidence in the systems your organisation depends on.

For others, PHP2Shell is the moment to ask whether PHP is still the right foundation. Arekibo builds and hosts on Umbraco and Sitefinity, two content management platforms running on Microsoft Azure. The underlying platform is maintained and patched by Microsoft, there's no risk of being stranded on an unsupported version, and this type of vulnerability simply doesn't apply. We move your content, keep your web addresses and protect your search rankings, and the new site launches with ArekiboCare from day one.

PHP2Shell: Frequently Asked Questions

• What is PHP2Shell? PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. They allow attackers to take control of a web server running an unpatched version of PHP, without needing a password.
• Is my WordPress site affected by PHP2Shell? If it runs on a version of PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, yes. Updating WordPress or its plugins does not fix it; PHP itself must be updated by whoever manages your hosting.
• How can I protect my website from PHP vulnerabilities like this? Make sure someone is clearly responsible for patching PHP and acts within hours, not weeks. For a longer-term fix, consider a managed service such as ArekiboCare, which covers hosting, monitoring and security under a fixed-price 24/7/365 SLA, or moving to a platform like Umbraco or Sitefinity where the underlying technology is maintained by Microsoft.

Security Starts Below the Application

PHP2Shell is a reminder that security isn't only about the code you write. It's about the platform it runs on, who owns it, and how quickly they can act.

If you're unsure whether your site is exposed, or whether anyone is responsible for finding out, get in touch. We'll check your runtime, confirm your exposure and talk you through the options.