What happened
PHP is the programming language behind WordPress, Drupal, Magento, Laravel and a lot of custom-built systems. W3Techs puts it at around 69% of the websites whose server-side language can be identified. On 21st October, the team that maintains it released fixes for two critical security flaws (CVE-2026-109618 and CVE-2026-109619), which security researchers have named PHP2Shell. The UK's National Cyber Security Centre put out an alert the same day, warning that every version of PHP is affected. Researchers have traced the flaws back as far as PHP 5.4.
“PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.”
In practice, that meant someone could install malicious software on a server, or take a website offline, without needing a password. Cyber security agencies across the UK and Europe urged everyone to update quickly, and some organisations, including the Finnish government and the Dutch national cyber security centre, took websites offline while they did.
PHP's developers published the fixed versions at 3pm UK time: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
What we did for the websites we host
We heard about the flaws when they were announced on the morning of the 21st, and started reviewing every server we manage straight away, so we'd be ready to act the moment the fix and the official advice came out. Nearly all of the websites we host also sit behind Cloudflare, which added its own protection against the flaws the same day.
| Time | What happened |
|---|---|
| Morning | The flaws are announced, and we start reviewing every server we manage |
| 3pm | PHP's developers publish the fixed versions and their advice |
| 3.20pm | Protective measures in place across all of our servers, following the NCSC's advice |
| Evening | The updated software becomes available for our servers, sooner than we'd expected |
| 6.35pm | Every server we manage running the fixed version |
We installed the update one server at a time, checking every website after each step, and once the fix was in place we removed the temporary measures. Our hosting clients didn't need to do anything, and there was no charge.
What to check if your website is hosted elsewhere
If someone else hosts your website, it's worth asking them two things: whether PHP on your server has been updated to one of the fixed versions or newer, and which version of PHP your site runs on.
It needs fixing on the server rather than in WordPress, so it's your host's job unless you manage the server yourself.
The second question matters because the official fixes only cover PHP 8.2 and newer. PHP's developers released limited fixes for PHP 7.4, 8.0 and 8.1 for people who build PHP themselves, and some providers offer their own extended support, but anything older than 7.4 has no official fix. Plenty of older websites still run on PHP 7, and those are the most exposed now.
If your site is on an older version, the answer is to move it to a supported one, ideally PHP 8.3 or newer, as 8.2 stops receiving security fixes at the end of December. Older themes, plugins and custom code can stop working on a newer version of PHP, so it's worth testing the move properly before it goes live.
How we can help
If your website is hosted elsewhere and you're not sure it's had the fix, get in touch and we'll take a look and let you know where it stands, free of charge.
If it needs updating, or it's running on a version of PHP too old to be fixed, we'll quote for moving it onto a current version, and onto our managed hosting if you'd like us to look after it from here.
Sources
Wonder Media is a web design and development agency in Harrogate, building, hosting and looking after websites and web systems since 2006.