By Eric Vollbrecht, Senior Security Consultant, Mytech Partners
Key Takeaways
Current as of October 30, 2026
- PHP2Shell is two critical flaws in PHP, the software that runs a large share of the world’s websites. They let an attacker take over a web server without a password.
- Attacks are already happening. Attempts began before the fix was public and quickly reached the millions.
- Your website is the most likely exposure, and it’s usually managed by someone else. If your website host or web team hasn’t confirmed the October 21 update, ask them today.
What is PHP2Shell?
PHP2Shell is the nickname for two serious security flaws in PHP. If your website hasn’t been updated, an attacker could take it over without needing a password.
PHP is the behind-the-scenes software that powers most business websites, including anything built on WordPress, plus many online stores, client portals, and login pages. Think of it as the plumbing in your building: you never think about it until someone tells you the pipes have a problem. This time, the pipes have a problem.
The fix came out on October 21, 2026. Your website host applies it on the server, so you don’t need to install anything yourself. You just need to confirm they did.
For your IT team or web developer: the flaws are tracked as CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older need a vendor patch or an upgrade.
Is anyone exploiting PHP2Shell?
Yes. This is a patch-now event, not a wait-and-see one.
- Attacks started early. Attempts began on October 17, four days before the fix was released, after technical details leaked ahead of the planned announcement.
- The volume is high. Attempts reached the millions within a day of the patch.
- Break-ins are confirmed. On October 24, researchers recorded attackers successfully running code on a server with unpatched PHP.
- It’s reaching security devices. On October 28, a firewall’s internet-facing management page was reported compromised through PHP2Shell and then used as a launching point into the network it was meant to protect.
- The exposure is wide. About 1.57 million internet-facing PHP servers were unpatched on release day, and at least 1 million run older PHP versions with no official fix.
The National Security Agency (NSA) advises taking systems offline if they can’t be updated right away.
Am I affected by PHP2Shell?
If your website runs on PHP and hasn’t received the October 21 update, assume yes. That includes most WordPress, Drupal, and Joomla sites, plus many online stores, client portals, and booking or payment pages.
One common misunderstanding: updating WordPress does not fix PHP. WordPress and its plugins run on top of PHP. The PHP update happens on the server, which is usually your hosting provider’s job, not something you click in your site’s dashboard.
We’ve seen this firsthand. Mytech’s own website was running a vulnerable PHP version through our hosting provider, and the provider patched it. That’s the outcome you want, and it’s why the next step is a quick conversation with whoever hosts your site.
We don’t host our own website. Are we safe?
Not necessarily. PHP doesn’t only run websites. It also runs inside hosting platforms, the admin pages of firewalls and network storage devices, and many vendor products that nobody thinks of as “a website.”
Several major firewall makers have published advisories listing affected products (coverage from Help Net Security). If a vendor product runs PHP, the fix arrives only when that vendor ships an update. If Mytech manages your IT, we’re already tracking vendor advisories for the devices and software we support, including business applications installed on your own servers or on servers we manage, and following up until the fix lands. For anything hosted by someone else, such as a cloud-based business application or your website, ask that vendor whether their product is affected and when a fix will be available.
What should I ask my website host about PHP2Shell?
If you haven’t heard from whoever hosts or manages your website, reach out and ask these five questions. Copy them straight into an email:
- Which PHP version is our website running?
- Has PHP been updated with the October 21 security fix, and on what date?
- Was PHP restarted after the update so the fix took effect?
- Have you checked our site for signs of compromise since October 17?
- How quickly do you normally apply critical security patches?
That last question matters beyond this week. A good host patched this without being asked and can tell you exactly when. If you had to chase them for an answer, or the answer is “we’re looking into it” more than a week after the fix shipped, that tells you how they’ll handle the next one too. This is a good moment to decide whether your host is proactive about security or just keeping the lights on.
What should I ask my IT team or vendors about PHP2Shell?
You don’t need to do the patching yourself. Your job is to make sure the right people are on it. Your website is the one check everyone owns, Mytech clients included. Mytech doesn’t host websites, so confirm that one directly with your host using the five questions above. For everything else, if Mytech isn’t your IT provider, take these questions to your internal IT team, your managed IT provider, or your software vendors:
- “Do we know everywhere PHP runs?” That means the website, client portals, online forms, and any device or vendor product with a web-based admin page.
- “Has everything facing the internet been patched?” Those systems are the most exposed and should be first in line.
- “Are we following vendor advisories for products that include PHP?” Fixes for those come from the vendor, not from PHP directly.
- “Is there anything we can’t patch yet, and what’s the plan?” Taking a system offline is a business decision as well as a technical one, so you should be part of that call.
- “Have you checked for signs of a break-in since October 17?” Anything left unpatched since then deserves a closer look.
What is Mytech doing about PHP2Shell?
For the environments we manage, we’re monitoring client networks and devices for vulnerable PHP and signs of exploitation, and following vendor advisories for the systems we support. If we find something that affects you, we’ll reach out to you directly.
Two things sit outside what we manage, and they’re yours to confirm:
- Your website. Mytech doesn’t host websites, so we can’t confirm whether your site has the update. The five questions above make it a two-minute email to your host.
- Your cloud-hosted business software. Cloud-based accounting, practice management, and other industry-specific applications are hosted by the companies that make them. Ask that vendor whether PHP2Shell affects it and when their fix will ship. If the software runs on your own servers or on servers we manage, we’re already checking it.
Already a Mytech client? Questions are always welcome. Submit a ticket or reach out to your Business Technology Manager (BTM) anytime.
Not a Mytech client? If you’re not sure who’s watching for threats like this one, or your current provider went quiet this week, that’s worth a conversation. Let’s chat and we’ll walk through where your business stands, no strings attached.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is two critical security flaws in PHP (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10. They let an attacker take control of a web server without a password.
Is my WordPress website affected by PHP2Shell?
It is if the server running it hasn’t been updated to a patched PHP release. Updating WordPress itself does not fix PHP. Ask your hosting provider to confirm the PHP update.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21, 2026. PHP 8.1 and older have no official fix and need a vendor patch or an upgrade.
Is PHP2Shell being exploited?
Yes. Attack attempts began October 17, 2026, reached the millions within days, and successful break-ins have been confirmed.
What should I ask my website host about PHP2Shell?
Ask which PHP version your site runs, whether it was patched and when, whether PHP was restarted afterward, whether they checked for signs of compromise, and how quickly they normally apply critical patches.
Sources Used
- PHP security advisories
- NCSC-NL: PHP2Shell operational information
- BleepingComputer: confirmed exploitation
- SecurityWeek: exploitation timeline
- Help Net Security: affected security products
- SecureWorld: NSA guidance
- FortiGuard Outbreak Alert: PHP2Shell
