When a car manufacturer finds a fault in a part that many of its models share, it issues a recall, and every owner needs the fix whether or not anything has gone wrong yet. Software has the same kind of event. On 20 October 2026, the PHP project warned website owners of two critical security flaws, now known as PHP2Shell, and released the fixes the following day.
In short, PHP2Shell allowed an attacker to run their own code on a web server without logging in, so any website running an unpatched version of PHP was at risk. PHP runs on the server, so the fix is an update that your hosting provider installs on its servers. We installed the fixed versions on our servers on 22 October, the day after they were released, with no downtime for the websites we host.
What Is PHP2Shell, and Is Your Website Affected?
PHP2Shell is the name given to two critical flaws in PHP, recorded as CVE-2026-109618 and CVE-2026-109619. They allow an attacker to run code on a web server without logging in. Any website built on PHP, including every WordPress website, is affected until the server it runs on has a fixed version of PHP.
Key Points
- PHP2Shell is two critical flaws in PHP, announced on 20 October 2026 and fixed on 21 October 2026.
- Websites built on PHP, including WordPress websites, are affected until the server runs a fixed version.
- The fix is installed by the hosting provider, and each website's PHP has to be restarted before the fix takes effect.
- The PHP project released fixed versions only for PHP 8.2 and newer; older versions depend on the hosting platform.
- Valse installed the fixes on its servers on 22 October 2026, with no downtime for the websites we host.
What Happened, Day by Day
| Date | What happened |
|---|---|
| 20 October 2026 | The PHP project warned of two critical flaws and asked server administrators to prepare to update |
| 21 October 2026 | Fixed versions released: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 |
| 22 October 2026 | We installed the fixed versions on our servers and restarted PHP for the websites we host |
Why the Fix Is Your Hosting Provider's Job
PHP is the engine on the web server that turns a website's code into the pages your visitors see. A website owner can update the website's own software, such as WordPress and its plugins, from the website's admin panel. PHP itself can only be updated on the server, so for most businesses it is installed by the hosting provider or by the company that looks after the website.
There is a second step that is easy to miss. Installing a new version of PHP does not change the websites already running on the old one. Each website's PHP has to be restarted before it uses the fixed version, and a careful provider checks that every website has done so.
Older versions of PHP need one more consideration. The PHP project released fixed versions only for PHP 8.2 and newer, the versions it still supports. A website on an older version depends on its hosting platform to provide a fixed build of its own, so it helps to know which version your website runs.
Questions to Ask Your Website Provider
- Which version of PHP does my website run, and is that version still supported?
- Has the PHP2Shell fix been installed on the server that hosts my website, and when?
- Was PHP restarted after the update, so that my website runs the fixed version?
- Who is responsible for security updates to the server, and how will I be told when one is applied?
A provider that looks after its servers well can answer each of these quickly and clearly. We explain what a good arrangement includes in our guide to website maintenance in Malaysia.
How We Handled PHP2Shell at Valse
Every website we build runs on NagaCloud, the platform we built and operate ourselves, and our own team looks after the servers it runs on. On 22 October 2026, the day after the fixes were released, we installed the fixed versions of PHP on our servers and restarted PHP for the websites we host, checking that each website responded the same way before and after. There was no downtime, and our clients did not need to do anything. Fixed builds for older PHP versions came later from our hosting platform, and we have installed those as well. You can read more about our website design and support.
Want to know where your website stands? Take the free RIDE Digital Scorecard, or talk to us today.