Client Advisory: PHP2Shell Flaws Put PHP Websites at Risk
On October 21, 2026, the PHP Foundation released emergency fixes for two critical vulnerabilities. Security researchers call them PHP2Shell. An attacker can take over an unpatched web server with a single request, and no password is needed.
PHP powers most of the web, including the common WordPress website builder platform. So the natural question many of our clients have asked this week is simple: are we exposed? Here is how we have answered it.
What happened
The flaws (CVE-2026-109618 and CVE-2026-109619) let an outside attacker run their own code on an exposed web server.
Each carries a severity score of 9.2 out of 10.
Amazon’s threat intelligence team reported an exploitation attempt four days before the public announcement. Since the fixes came out, security firms have seen thousands of attack attempts.
CISA, the U.S. cybersecurity agency, urged organizations to patch impacted systems immediately.
Older versions of PHP no longer get security fixes. Sites still running them need an upgrade.
How the attack works
The attack happens on the server, not on anyone’s screen. Your team will not see a suspicious email or prompt. That is why maintaining your cybersecurity posture is critical. With novel exploits being released with increasing frequency, confirming your vendors follow the same standards is key.
This particular incident highlights two controls which help contain potential exploitability beyond patching:
Regular vulnerability scanning of your public-facing systems and website. Scans flag outdated software like an unpatched PHP version, so you find it before an attacker does.
Web application firewall (WAF) technology. A WAF screens traffic before it reaches your site and can filter many known attack patterns, including some used against PHP2Shell. It reduces risk though it doesn’t negate patching.
Is your website a gateway to your data?
It depends on what the site holds and what it connects to. We break exposure into four areas:
Your front door website. The main risk is reputational. An attacker could deface it, serve malware to visitors or host a phishing page on your domain. Reputational damage could spread and impact areas like email deliverability if undetected.
Portals and vendor platforms. Client portals, file-sharing platforms, CRMs and outsourced administrators often hold critical data. Their patch status is your risk.
Connected systems. A compromised server can give an attacker a path into the databases, forms and tools it links to.
Network appliances. Some firewalls and appliances embed PHP. For instance, Palo Alto Networks has confirmed its PAN-OS firewall software is affected and, as of October 22, had not released fixed versions.
For most firms, the biggest unknown is not their own website. It is the vendors they rely on.
What to do this week
Confirm your own website status. If you are not sure whether your website runs on WordPress or relies on PHP, reach out to your website developer and hosting partner.
Ask your vendors specific questions. Start with the providers that store your data or that your team logs into.
Keep the responses. Written confirmation supports your audit and due diligence records.
If you invest in or oversee other companies
Private equity firms, venture funds and holding companies carry exposure across every company they back. Ask each portfolio company to identify its PHP-based systems, patch them, confirm with its hosting providers and review logs. A one-week deadline gives you a single view across the portfolio.
Investment firms should also put their investor portal, data room and fund administrator at the top of the vendor list.
Questions to send your vendors
Do any systems that store our data, or that our users log into, run PHP?
Have you applied PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor backport? On what date?
If not, what interim protection is in place, and when will you patch?
Have you reviewed logs for signs of exploitation since October 17, 2026?
Have you confirmed the status of your own hosting providers?
Large providers may reply with a standard statement. Keep it on file, and follow up once if it skips the patch date or log review.
Looking ahead
The researchers who found these long-standing flaws used AI models in their work. Security leaders warn that AI-assisted analysis makes it cheaper and faster to turn a published fix into a working attack. That shortens the window between disclosure and real-world exploitation.
Two steps help you move faster next time:
Keep a current list of every internet-facing system and the vendor behind it.
If your website runs on WordPress, consider whether a modern platform without PHP exposure fits your 2027 plans.
If a critical flaw dropped tomorrow, how long would it take you to know which vendors were affected?
Need help?
InnerCircle clients: if we manage your WordPress website directly, we have already mitigated this vulnerability with our managed hosting provider. We are reviewing the other systems we manage and will contact you directly if action is needed. Report anything suspicious to helpdesk@innercircleit.com.
Not a client yet? Contact our team to talk through your exposure.