PHP2Shell: What the PHP Security Flaws Mean for Your Website

On 21 October 2026, the team behind PHP released emergency security updates for two critical PHP security vulnerabilities, nicknamed PHP2Shell. PHP is the programming language that powers a large share of the world's websites, including WordPress, many online shops and our own Hydra CMS. So when PHP has a serious problem, a lot of the web has a serious problem.

This article explains, in plain English, what happened, who's affected, what website owners should do, and how we've looked after our clients.

What is PHP2Shell?

Two vulnerabilities, officially numbered CVE-2026-109618 and CVE-2026-109619, were found in PHP itself, not in a particular website or plugin. Both are rated 9.2 out of 10 for severity.

In simple terms, the flaws could let an attacker run their own code on a web server without needing to log in. Once someone can do that, they can potentially:

• steal data, such as customer details or form submissions
• change or deface a website
• install malware or use the server to attack others
• use the server as a stepping stone into other systems

Technically, one flaw involves how PHP handles memory when it runs out, and the other involves information PHP keeps hold of between one visitor's request and the next. You don't need to understand the details. What matters is that they were serious enough for security agencies across Europe and the US to issue urgent advisories.

Why it moved so fast

The timeline shows why this was treated as an emergency:

• 17 October: Amazon's threat intelligence team spotted an attempt to exploit the flaws, four days before they were made public.
• 20 October: details leaked online two days ahead of the planned announcement.
• 21 October: PHP released fixed versions early.
• In the days since: security researchers have reported active attempts to exploit both flaws.

When attackers are already trying to use a flaw before the fix is even out, every hour counts.

Which PHP versions are affected?

Almost every PHP version in use today is affected: PHP 5.4 right up to 8.5. That covers the vast majority of PHP websites.

The fixed versions are:

PHP versions that fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

PHP branch	Safe version
8.5	8.5.12 or later
8.4	8.4.27 or later
8.3	8.3.36 or later
8.2	8.2.35 or later

PHP versions 7.4 to 8.1 are no longer officially supported. The PHP security team published unofficial fixes for them, but there are no official updated releases. If your website still runs on one of these older versions, now is the time to move to a supported version.

A third, separate flaw (CVE-2026-115560) was announced on 23 October. It only affects websites set up in unusual ways, so the risk to most sites is low, and PHP isn't rushing out an emergency release for it. We're keeping an eye on it.

What should website owners do?

If you run a PHP website, whether or not we built it, here's what we recommend:

1. Find out which PHP version your site runs. Your hosting control panel usually shows it, or you can ask your hosting company.
2. Make sure it's been updated to one of the safe versions in the table above.
3. If you're on PHP 7.4 to 8.1, plan an upgrade to a supported version. Older websites may need some code changes to work on newer PHP, so it's worth getting a developer to check.
4. Update everything else too: your content management system, themes and plugins.
5. Check for signs of trouble, such as unexpected new user accounts, files you don't recognise, unusual traffic or changes to your site you didn't make.
6. Keep backups and make sure you know how to restore them.

If you're not sure where to start, get in touch and we'll be happy to help, even if we didn't build your site.

How we've looked after our clients

As soon as the fixes were released, we got to work on the websites and systems we manage:

• We checked every server we look after to confirm which PHP version it was running.
• We applied the security updates so that client websites are running the fixed versions of PHP.
• We reviewed our hosting partners' responses to make sure servers outside our direct control were also patched.
• We looked for signs of attempted attacks in server logs around the dates the flaws were being exploited.
• We're following the third, lower-risk flaw and will act if anything changes.

Our clients didn't need to do anything. That's the point of a properly managed website: when something like this happens, the people looking after your site deal with it, and you hear about it afterwards rather than finding out the hard way.

Why Hydra sites were in a strong position

Many of our clients' websites run on Hydra, the content management system we build and maintain ourselves. A few things about Hydra helped here:

• No third-party plugins. Many attacks on websites come through plugins written by other people (see is plugin debt killing your business growth?). Hydra doesn't use them, so there are fewer ways in.
• Nightly updates. Hydra is kept up to date continuously, so it's always ready to run on the latest, safest version of PHP.
• We know every line of it. Because we wrote Hydra, we can quickly check how a new vulnerability might affect it, rather than waiting on someone else to respond.

No system is immune to a flaw in the language underneath it. PHP2Shell affected PHP itself, so every PHP website needed updating. But being able to act quickly, with full knowledge of the code and servers involved, makes a real difference.

The bigger lesson: websites need looking after

A website isn't something you build once and forget. The software underneath it, from the server and PHP to the content management system, constantly receives security updates. Sites that are left unmaintained are the ones attackers find easiest to break into.

That's why ongoing care and maintenance is part of how we design and build websites. Keeping your site secure protects your business, your reputation and your customers' data.

PHP2Shell: frequently asked questions

Need a hand?

If you're worried about your website's security, aren't sure which version of PHP it's running, or would like someone to take care of updates for you, get in touch with Cirrus Design Studio. We'll check your site and let you know where you stand.

Sources: PHP 8 changelog, CERT-EU security advisory, Tenable PHP2Shell FAQ, Rapid7 analysis, watchTowr PHP2Shell FAQ.