PHP2Shell: if your site runs PHP 8.1 or older, no official release is coming.

On 20 October the PHP project warned that an emergency security release was coming for flaws in PHP itself. Details leaked online before the fixes were ready. On 21 October PHP shipped them in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10, and have become known as PHP2Shell.

Attacks did not wait for the patch. Cloudflare reported attack traffic against its customers and attackers reworking their payloads to slip past its filters. Security firm watchTowr saw exploitation in the wild, and CERT-EU noted proofs of concept circulating.

In the Netherlands the NCSC advised owners of PHP websites to weigh up taking them offline until a fix was in place. DigiD, MijnOverheid, Overheid.nl and the Tweede Kamer website went offline as a precaution, RIVM took several of its sites down, and the 113 suicide prevention website was offline for hours while its phone line stayed open. The NCSC said it saw no active exploitation in the Netherlands, but it did see a rise in traffic from people probing websites for the weakness. Public bodies in France, Germany, Finland and Belgium took similar steps, according to AAP.

Most website breaches come through a plugin, a theme or a weak password. PHP2Shell sits a layer lower, in the runtime that executes your website's code. That is why updating WordPress does nothing for it, and why a five page brochure site is as exposed as a busy web shop.

In plain terms, an attacker sends a specially built request that makes PHP run out of memory part way through handling it. PHP then cleans up badly. Data that was only half set up gets treated as valid, and leftovers from one request survive into the next one the same worker handles. With care, the attacker turns that confusion into running their own code on your server.

PHP runs 69.2% of the websites whose server language is known, according to W3Techs. WordPress, WooCommerce, Drupal, Joomla, Magento and PrestaShop are all built on it. Wiz, the research team that found the flaws, says every PHP version released in the last decade is affected by at least one of them.

Fixed releases exist only for PHP 8.2 to 8.5, the versions PHP still supports. PHP 8.1 lost security support at the end of 2025, and anything older has been unsupported for years. W3Techs counts 34.6% of PHP sites still running version 7 or earlier. For 7.4, 8.0 and 8.1 the PHP security team published minimal source patches, which only help if someone builds and installs them; for anything older there is nothing. Some Linux distributions and paid support vendors ship backports, so the first question for your host is whether yours did.

One more date for the diary: PHP 8.2 stops receiving security fixes on 31 December 2026. If you are patching 8.2 this week, you are also planning an upgrade before New Year.

PHP2Shell was found with AI. Wiz Research says AI models from Google and OpenAI helped it find the flaws, adapt working exploits to different PHP versions and validate the fixes, and that a single researcher did the work in about a week. Calif, working with OpenAI, found one of the flaws as well.

That capability is not reserved for researchers who report what they find. The time between a flaw existing and a flaw being used is shrinking, and the oldest, least maintained sites are the easiest to find. A website nobody has touched in three years used to be safe because nobody was looking. Software is looking now, all day.

A server under someone else's control puts the database behind it in their hands, with your customers' names, emails and orders. Under GDPR a personal data breach has to be reported to the Autoriteit Persoonsgegevens, or your national regulator, within 72 hours of you becoming aware of it, and fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher.

If you take payments, an attacker can add a few lines to your checkout that copy card details as customers type them. You usually hear about it weeks later, from your payment provider.

Hacked servers get put to work. They host spam pages that Google can flag as hacked in its results, and they send phishing from your domain until mail providers block it, at which point your real invoices and proposals stop arriving.

And when a breach becomes news, the name in the headline is yours. The hosting company is a footnote.

We run a thirty minute website security call. We look at what your site actually runs, tell you plainly where you stand and what to fix first. If a patch is enough, we say so. If the site is overdue a rebuild, we redesign it on a modern stack, the way we built mudagym.com and helionics.io.