PHP2Shell Vulnerability: What Your Business Needs to Do This Week

Last updated: October 22, 2026. This is a fast-moving story. We will update this post as new guidance comes out.

PHP2Shell in Plain English

This week, two critical security flaws were announced in PHP, and together they are being called the PHP2Shell vulnerability. If you've never heard of PHP, that's fine. You don't need to. It's the behind-the-scenes engine that runs an estimated 70% of websites, including nearly every WordPress, Drupal, and Joomla site out there.

Think of it like a defect in an engine block, not in one specific car. The flaw isn't in your website's design or your plugins. It's in the engine underneath, which means almost everything built on top of it is affected.

Here's what it means in practice: an attacker on the internet can send a single request to an unpatched web server and take control of it. No password. No login. No one on your team has to click anything. Once they're in, they can change your website, steal the data on that server, or use it as a foothold to go after something bigger.

The good news is that a fix exists. The PHP team released patched versions on October 21. The work now is making sure every site and system that runs PHP actually gets that fix.

Why This One Is a Bigger Deal Than Most

We see security alerts every week. Most don't warrant an email to every client we have. This one does, for four reasons:

• It's rated 9.2 out of 10. Both flaws received a critical severity score from the PHP security team.
• It goes back more than a decade. The researchers who found it say every PHP version released in the last ten years is affected, all the way back to PHP 5.4. Old, forgotten sites are not safe because they're old. They're more exposed.
• Attackers got a head start. Amazon's threat intelligence team spotted an exploitation attempt on October 17, four days before the fix was public, and reported broad exploitation shortly after the patch was released.
• Governments are using unusually strong language. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch immediately. The UK's National Cyber Security Centre (NCSC) went further and told organizations to consider taking systems offline if they can't be fixed right away.

When a government agency tells businesses to unplug something, that's worth five minutes of your attention.

Is Your Business Affected?

For most businesses we work with, the honest answer is: your website might be, and your office probably isn't. Here's how to think about it.

Your website

This is where the real exposure is for most small and mid-sized businesses. If your website runs on WordPress, Drupal, Joomla, or was custom-built by a developer, it almost certainly runs on PHP. Whoever hosts and maintains it needs to confirm it has been updated.

If your site is built on Wix, Squarespace, or Shopify, the platform runs and patches the servers for you. You're in a much better spot, though it never hurts to confirm.

Hidden PHP inside your office

This is the part people miss. PHP doesn't only live on websites. It shows up in client portals, intranet tools, the web management page on a storage device, older line-of-business software, and that server someone set up years ago that nobody wants to touch. Any of those can be vulnerable if they're reachable from the internet.

What is probably not affected

Your laptops, your Microsoft 365 email and files, and your Teams calls are not the concern here. This is a web server problem, not a workstation problem.

What to Ask Your Web Developer This Week

You don't need to understand the technical details. You just need answers. Forward this list to whoever manages your website, whether that's a freelancer, an agency, or your hosting company:

1. What version of PHP is our site running, and has it been updated? The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. A hosting company may also apply the fix at the server level, which is fine as long as they confirm it in writing.
2. If we're on PHP 8.1 or older, what's the plan? Those versions no longer get official updates. The answer should be either a vendor-supplied backported fix or an upgrade to a supported version.
3. Have you checked for signs that someone already got in? Since attacks started before the fix was public, Amazon's guidance is to look back to at least October 17. Patching closes the door. It doesn't tell you whether someone walked through it first.
4. Is our site behind a web application firewall? Several major providers pushed out protective rules for this flaw. It's not a substitute for patching, but it's a useful extra layer.
5. Do we have a recent backup of the site stored somewhere other than the server itself? If the worst happens, this is what gets you back online.

A good web developer will be able to answer all five quickly. If you get vague answers or no answer at all, that tells you something too.

What If Nobody Owns Your Website?

We run into this all the time. The site was built by someone's nephew, or by an agency you stopped working with three years ago, and nobody's logged in since. Those sites are exactly what attackers are scanning for right now.

If that's you, you have two real options: find someone to update it this week, or take it offline until someone can. A temporary "we'll be right back" page is a lot cheaper than cleaning up after a compromised server, especially if that server has client information on it or is connected to anything else in your business.

Where Four Winds Fits In

We'll be straight with you: we are not web developers, and we don't host websites. Your web developer or hosting company owns the fix for your site. Anyone who tells you otherwise is probably trying to sell you something.

Here's what we do. For our managed clients, we're checking the systems we manage for any PHP software and will reach out directly if we find something that needs attention. And if your web developer needs help securing things, or you're not sure who your web developer even is, we'll get on the phone with them and work it out together. When you call us, you get an engineer, not a call tree. It's the same practical, no-scare-tactics approach we take to cybersecurity across the board.

Frequently Asked Questions

What is the PHP2Shell vulnerability?

PHP2Shell is the name for two critical security flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 and can let an attacker take control of a web server running PHP without a password. Patches were released on October 21, 2026.

Is my WordPress website vulnerable to PHP2Shell?

If your WordPress site runs on a PHP version older than the patched releases, yes. WordPress itself runs on PHP, so the fix has to happen on the server. Ask your web developer or hosting company to confirm your site is on PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a host-patched equivalent.

Is PHP2Shell being exploited right now?

Yes. Amazon's threat intelligence team saw an exploitation attempt on October 17, before the fix was public, and reported broad exploitation in the days after the patch was released. CISA and the UK NCSC both urged organizations to patch immediately.

Which PHP versions fix PHP2Shell?

The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive official updates, so sites on those versions need a backported fix from their vendor or an upgrade to a supported version.

Does PHP2Shell affect Microsoft 365 or my computers?

No. PHP2Shell affects web servers and devices that run PHP, not your laptops, Microsoft 365 email, or Teams. For most businesses, the main exposure is the company website and any web-based tools or devices that are reachable from the internet.

Sources

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (October 21, 2026)
• UK National Cyber Security Centre: Critical security issue affecting PHP (October 21, 2026)
• PHP.net: Official security release and downloads
• Amazon Threat Intelligence: PHP2Shell exploitation prior to public disclosure