PHP2Shell: What Business Owners Should Know
Newsroom > Insights
What is PHP2Shell?
PHP2Shell is a recently disclosed pair of critical security vulnerabilities in PHP, software that runs behind many websites and business applications. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Security fixes were released on October 21, 2026. If your business relies on a PHP-based website, your hosting provider or website developer should verify that those fixes are in place.
If your website takes orders, delivers files or supports client work, PHP2Shell is an operational risk. A compromise could interrupt revenue, expose information and delay customer projects.
PHP2Shell at a glance
CVE IDs: CVE-2026-109618 and CVE-2026-109619
Severity: Critical (CVSS 9.2 of 10)
Disclosed: October 21, 2026
Risk: Attackers can take over a server without logging in
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
What the FBI and governments are saying
The FBI’s cyber division warned that the vulnerabilities could let attackers remotely run code on servers using PHP, putting sensitive data and networks at risk. The agency recommended that operators take websites offline if they can’t update them immediately. The NSA and CISA issued the same urgent guidance: update now, or disconnect until you can.
Governments took that advice seriously. The Associated Press reported that agencies and corporations worked through the night on updates. The UK took some limited government services offline while fixes were applied. Finland’s government sites were disrupted, and Japan’s Prime Minister personally urged website operators to check whether they use PHP and patch immediately, or temporarily suspend their sites if they couldn’t.
Security experts told the AP that taking sites offline during patching is good practice, and that the effects will ripple out for weeks or months. One researcher described the current situation as “just the very early tremors.”
What could be affected
PHP powers about 70% of websites worldwide, including platforms like WordPress, Drupal and Joomla. If your business uses any of the following, check it:
Websites: WordPress, Joomla!, Drupal and similar platforms.
Online stores: WooCommerce (WordPress) and Magento shops.
Customer and staff portals: booking and intake forms, client login areas, learning portals like Moodle, help desk tools like osTicket.
Self-hosted business apps: file sharing like Nextcloud, CRMs like SuiteCRM, inventory and asset tracking tools.
Equipment with a web login page: phone systems (such as FreePBX), storage devices and other network gear that may carry its own copy of PHP.
Fully hosted site builders manage their own servers. The bigger concern is anything you, your developer or a vendor installed and maintain.
Your action plan
List what you have. Write down your website, online store, portals and anything your team logs into through a browser. Include anything a vendor set up for you.
Name who maintains each one. Your web developer, hosting company, software vendor or IT provider. If the answer is “nobody,” that’s a finding.
Ask each one directly. “Is this system affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it been updated to a fixed version?”
Update now, not next cycle. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Firewalls and security filters help, but they are not a complete fix.
If it can’t be updated, take it offline. That’s the FBI’s recommendation. A few hours of downtime costs far less than a breach.
Check for intruders. Updating doesn’t remove anything an attacker already left behind. Ask your provider to review for unfamiliar files, new user accounts or unusual activity, and change passwords tied to that system.
Retire old software. PHP 8.1 and older no longer get regular security updates. Plan to upgrade or replace anything still running on them.
PHP2Shell FAQ
What are CVE-2026-109618 and CVE-2026-109619?
They are the official tracking numbers for the two PHP vulnerabilities known together as PHP2Shell. Both can let an attacker run code on a web server without a password.
Is my WordPress site affected by CVE-2026-109618?
WordPress runs on PHP, so it’s affected unless the server underneath it has been updated. Ask your host or developer to confirm.
Does a firewall protect me from PHP2Shell?
It can reduce risk, but it isn’t a fix. Updating PHP is the only complete solution.
What if we can’t patch right away?
The FBI recommends taking the site offline until the update is in place.
The bigger lesson
Some of these flaws are more than a decade old. They were found by AI-assisted research, and the PHP Foundation has acknowledged it was slow to fix them. Expect more discoveries like this, faster. The businesses that come through cleanly already know what they run, who maintains it and how fast it gets updated.
Not sure where you stand? Run our free exposure check or reach out to CTRL-A, and we’ll help you work through the list.
About CTRL-A
CTRL-A Technical Services is a Riverside, California–based managed services provider delivering managed IT, cybersecurity, and on-site technical support. We help growing organizations reduce risk, strengthen operations, and maintain stability through structured, security-first technology services. Follow us on Instagram and LinkedIn to learn more.