If you have a website, there is a very good chance it runs on PHP. It powers platforms like WordPress, Drupal, and Joomla, which together account for a huge proportion of websites across the UK. When a critical security flaw is discovered in PHP itself, it does not just affect a handful of developers. It concerns millions of business owners who may not even know PHP is running quietly on their site.
That is exactly what happened in October 2026. Two severe vulnerabilities were discovered in PHP, now collectively known as “PHP2Shell.” The UK’s National Cyber Security Centre (NCSC) issued an urgent advisory encouraging UK organisations to take immediate action. Both vulnerabilities carry a severity score of 9.2 out of 10. To put that in context, a score of 9 or above is classified as critical.
The bottom line: If your website operates on PHP and has not been patched, it could be vulnerable to attackers right now.
This blog explains what the vulnerabilities actually mean in plain English, whether your site is at risk, and why having a web developer or agency on hand makes all the difference when issues like this surface.
What Is PHP2Shell?
PHP (which stands for PHP: Hypertext Preprocessor) is a server-side scripting language. In simple terms, it is the code that runs in the background of your website to make things work, from contact forms and login pages to product listings and content management systems.
PHP2Shell is the name given to two severe vulnerabilities discovered in PHP in October 2026, tracked as CVE-2026-109618 and CVE-2026-109619. Here is what each one actually does:
CVE-2026-109618: Out-of-memory handling flaw
This vulnerability exploits the way PHP handles memory when it runs out of resources. Under certain conditions, PHP can be interrupted mid-process, leaving internal data in an incomplete state. An attacker can then manipulate that incomplete data to run their own malicious code on your server.
CVE-2026-109619: Use-after-free vulnerability
This one involves PHP accidentally reusing memory that has already been freed. A later web request handled by the same server process can pick up that “stale” leftover data. Again, an attacker can exploit this to execute arbitrary code remotely.
Both vulnerabilities allow what is called unauthenticated remote code execution. That means an attacker does not need a login, a password, or any prior access to your site. They can send a specially crafted web request and, if your server is unpatched, potentially take control of it.
Why this is especially serious: PHP processes incoming web requests before your WordPress, Drupal, or any other application code runs. That means the vulnerability exists at the server level, not the website level. Updating your WordPress plugins alone will not fix it.
Is Your Website at Risk?
The short answer is: if your website runs PHP and has not been updated since 21 October 2026, yes.
Palo Alto Networks identified over 22.6 million publicly exposed instances that may be vulnerable to these flaws. Exploitation in the wild has already been confirmed, and the US Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities catalogue on 26 October 2026.
You are likely affected if your site uses any of the following:
- WordPress (the most widely used PHP-based CMS in the world)
- Drupal
- Joomla
- Laravel or other PHP frameworks
- Any custom-built website running on a PHP server
It is also worth noting that PHP is sometimes installed as a component of other software, meaning it might be running on your server even if you do not think of your site as a “PHP website.” If you are unsure, this is exactly the kind of thing a web developer can look for quickly.
Older PHP versions carry extra risk. PHP versions 8.1 and earlier are no longer officially supported, meaning they do not receive security updates at all. If your site is running on an older version, CISA recommends taking those systems offline until they can be patched or upgraded.
What Could Happen If Your Site Is Exploited?
This is not a theoretical risk. Proof-of-concept exploits for PHP2Shell were developed and publicly available within days of the vulnerabilities being disclosed. Security researchers at Wiz used AI tools to build a working exploit in under a week, a task they noted would previously have taken months.
If an attacker successfully exploits these vulnerabilities on your server, the potential consequences include:
- Full server takeover, giving attackers the ability to run any commands they choose
- Data theft, including customer information, payment details, or login credentials
- Malware installation, which could affect your visitors as well as your own systems
- Website defacement or complete takedown
- Your site being used to attack others, turning your server into part of a wider criminal network
- Backdoors being installed, meaning attackers retain access even after you think the issue is resolved
The damage to your business reputation, customer trust, and search engine rankings from a successful attack can take months to recover from. As our website security essentials guide covers, prevention is always far less costly than recovery.
What Needs to Be Done to Fix It?
Security patches have been released. The fix is to update PHP to one of the following versions, depending on which branch your server is running:
- PHP 8.5 users: update to 8.5.12
- PHP 8.4 users: update to 8.4.27
- PHP 8.3 users: update to 8.3.36
- PHP 8.2 users: update to 8.2.35
If your site is running PHP 8.1 or older, those versions no longer receive official security patches. The recommended course of action is to upgrade to a currently supported version as a matter of urgency.
It is not as simple as clicking “update”
Here is where things get complicated for most business owners. Updating PHP at the server level is not like updating a WordPress plugin. It requires:
- Access to your web hosting control panel or server environment
- Checking that your current theme, plugins, and custom code are compatible with the new PHP version before updating (a version jump can break things if done without testing)
- Verifying the update has applied correctly and your site is still functioning properly
- Checking for any signs of compromise before patching, in case attackers have already installed backdoors
The NCSC specifically advises that if you are not confident in your ability to assess your system for compromise, you should seek assistance from a professional. That is sound advice. Getting the patching process wrong, or missing a backdoor that was already installed, can leave you in a worse position than before.
Why Having a Web Developer Makes This So Much Easier
This is the part that does not get talked about enough. When a critical security issue like PHP2Shell surfaces, businesses with an ongoing relationship with a web developer or agency are in a completely different position from those going it alone.
Here is the practical difference:
You do not have to figure out if you are affected
A developer already knows your hosting environment, your PHP version, and your site setup. Rather than spending hours trying to work out whether you are running a vulnerable version, you make one call and get a straight answer.
Patches get tested before they go live
A competent developer does not just flip the PHP version and hope for the best. They test the update in a staging environment first, check for compatibility issues with your plugins and custom code, and only push the change to your live site once they are confident it will not break anything.
You get a proper security check, not just a patch
Updating PHP addresses the vulnerability going forward. But if your site was already exposed before the patch, there is a chance attackers have already been in. A developer can review your server logs, look for suspicious activity, and look for signs of compromise that a non-technical business owner simply would not know to look for.
You are protected from the next one too
PHP2Shell will not be the last critical vulnerability to affect widely used web software. Businesses that invest in ongoing website maintenance are not scrambling every time a new advisory lands. Security updates, PHP version management, and compatibility checks are handled as a matter of routine, not as a crisis response.
The real cost of not having support: When businesses without a developer relationship try to handle server-level updates themselves, the most common outcomes are either nothing getting done (leaving the vulnerability open) or something going wrong during the update (taking the site offline at the worst possible time). Neither is a good outcome.
What Should You Do Right Now?
If you are unsure whether your website has been patched, do not wait. Here is a sensible set of immediate steps:
- Contact your web developer or hosting provider and ask them to confirm which version of PHP your site is running and whether it has been updated since 21 October 2026.
- If you do not have a developer, contact a reputable web agency who can assess your site, apply the necessary updates, and scan for any signs of compromise.
- Do not rely solely on your hosting provider to have handled this. Some managed hosting environments update PHP automatically, but many do not. Verify it has been done.
- Check your third-party software too. PHP is often bundled into plugins, appliances, and other tools. Ask your developer to check whether any third-party components on your site also carry a PHP dependency.
- Keep monitoring. The PHP Security Team has already released a third related vulnerability (CVE-2026-115560) since the original disclosure. This situation is still evolving, and staying on top of updates is essential.
Our guide on why you should keep your website up to date covers the wider case for regular maintenance, but PHP2Shell is a timely reminder of what is at stake when updates are left to chance.
We Can Help
At DBS Digital, our website maintenance service covers exactly this kind of situation. We monitor for security advisories, manage PHP version updates, test compatibility before anything goes live, and keep your site running safely without you needing to understand the technical details yourself.
If you are concerned about your site’s security in light of the PHP2Shell vulnerabilities, or you simply want the peace of mind that comes with having a professional team looking after your website, get in touch with us today. We are happy to have a look and let you know exactly where things stand.
