CYBER SECURITY · PHP2SHELL
PHP2Shell: What the PHP Vulnerability in the News Means for Your Business
You've probably seen PHP2Shell in the news. It's a serious flaw in PHP, the software behind around 70% of websites, and if your business has a website or web portal there's a good chance it's affected.
NOT SURE IF PHP2SHELL AFFECTS YOU?
Talk it through with a Lucidity advisor and get PHP2Shell advice tailored to your setup.
One conversation, no obligation.
What’s happened?
On 22 October (NZ time), the PHP project released emergency fixes for two critical flaws, which security researchers have named PHP2Shell. Both let an attacker run their own code on a web server without needing a username or password. Simply put, an attacker can take control of the server and anything on it.
The National Cyber Security Centre (NCSC) issued an alert the same morning, urging New Zealand organisations to update as soon as possible and saying it was aware of reports of active exploitation. Overseas, several government agencies took websites offline while they patched, including Australia’s own cyber security agency.
The good news is that most of the activity so far has been attackers scanning for vulnerable servers, and as at 29 October, Wordfence (a widely used WordPress security plugin) says it isn’t aware of any WordPress site compromised through PHP2Shell. That’s not a reason to wait, though: Cloudflare saw millions of attempts within a day of the fixes being released, and the attackers only need to find the servers nobody has patched.
Not sure what your website runs on? Book a consultation with Lucidity →
Cyber Security · PHP2Shell
Know what's exposed and who's fixing it
A Lucidity advisor helps you find where PHP runs in your business and what to ask each provider.
- A list of the websites, apps and devices running PHP
- Who is responsible for patching each one
- The questions to put to your web provider
- Next steps for anything that can't be patched
Tailored to your setup, not a template.
What is PHP?
When you visit a website, your browser asks a server for a page. On most business websites that page doesn’t exist as a finished file. Software on the server builds it on the spot: it pulls your latest blog posts or product prices out of a database, checks whether you’re logged in, and sends back the finished page.
PHP is the programming language doing that job on a lot of the internet. W3Techs, which tracks this, puts it at 69% of websites where it can tell what’s running on the server. You never see PHP, and neither do your visitors. It sits underneath your website the same way Windows sits underneath Microsoft Word.
This flaw is in PHP itself, not in a particular website, theme or plugin. A well-maintained WordPress site is still exposed if the server underneath it runs an unpatched version of PHP, and updating WordPress won’t fix it. The flaws also go back more than a decade, so older sites aren’t off the hook either.
Which of your apps could be affected?
Most businesses haven’t installed PHP themselves, but it comes bundled inside a lot of the things you use. You’re most likely to find it in these places:
-
1
Your website
If your website was built by a local web designer in the last 15 years, there's a good chance it's WordPress, which runs on PHP. WordPress alone powers almost 40% of all websites. Joomla and Drupal sites run on PHP too.
-
2
Your online shop
WooCommerce, which adds a shop to a WordPress site, runs on PHP, as does Magento (now Adobe Commerce).
-
3
Portals and web apps
Booking systems, customer and supplier portals, intranets, and learning platforms like Moodle. If a developer built a web app for you, ask them what it's written in. PHP is one of the most common answers.
-
4
Hosting control panels and admin tools
cPanel and Plesk, the dashboards many hosting companies give you to manage your website and email, include their own copies of PHP. So does phpMyAdmin, a common tool for managing website databases.
-
5
Devices on your network
Firewalls, network storage (NAS) boxes and other devices with a web-based admin page sometimes run PHP under the bonnet. Cisco, QNAP and Synology have all published advisories for affected products, and NCSC says firewalls, edge devices and embedded platforms need to be assessed separately against each vendor's guidance.
Who isn't affected
PHP2Shell affects servers and devices that serve web pages. Your team's laptops, phones and tablets don't need anything installed, and staff don't need to do anything differently.
Recognise some of these in your business? Book a consultation with Lucidity →
Your cloud providers are already on it
For the cloud services you subscribe to – Microsoft 365, Xero, your CRM or practice management system – keeping the servers patched is the provider’s job. Whether or not they use PHP behind the scenes, there’s nothing for you to install.
The big platforms moved quickly. Microsoft had fixed versions of PHP rolling out to Azure App Service, its web hosting platform, on the day of the release. Managed WordPress hosts such as WP Engine and Kinsta finished patching within about a day, and Cloudflare put protective firewall rules in front of its customers’ websites, including those on free plans.
At Lucidity, we’re actively monitoring PHP2Shell and working with the vendors we partner with to make sure it’s mitigated and then resolved.
That’s how it should work, and it’s one of the real benefits of cloud services, but it doesn’t cover everything.
Why it still pays to check
Cloud doesn’t mean someone else is responsible for everything. These are the gaps I’d check:
- Servers you or your developer manage, like a virtual server in Azure or AWS, or a VPS (virtual private server) from a hosting company. The provider looks after the hardware, but updating PHP is up to whoever manages the server.
- Old versions of PHP. PHP 8.1 and earlier no longer get official updates. Some hosts have patched or worked around them, but not all - Microsoft says there's no patch planned for the old built-in PHP on Azure App Service for Windows.
- Hosts that are still catching up. Some hosting companies were still rolling out fixes in stages days after the release.
- Apps that carry their own copy of PHP, including software running in containers. Updating the server doesn't update the copy inside.
- Anything that happened before the patch. Patching closes the gap, but it doesn't tell you whether someone got in first. NCSC recommends checking affected systems for signs of compromise.
- Devices. No cloud provider is patching your firewall or NAS for you.
Not sure who manages your servers? Book a consultation with Lucidity →
WordPress and the third-party problem
I expect the most common exposure for our customers will be their WordPress website. In most cases it isn’t looked after by us or by their internal IT. It was built by a web designer or agency, who often hosts it too, sometimes on a server they manage themselves.
Some of these providers do a great job. Plenty are small operators who are excellent at design but don’t have a proper patching process, and a lot of sites only get touched when someone wants a content change. On a site nobody is actively looking after, I’d expect to find some of these:
- PHP several versions behind, because upgrading might break an old theme or plugin
- WordPress, plugins and themes that haven't been updated in months, sometimes years
- Plugins that were installed once, never used, and are still sitting there
- Shared admin logins with no multi-factor authentication (MFA)
- Nobody watching for alerts, so a compromise could go unnoticed for months
- Backups stored on the same server as the site, or no backups at all
- No clear agreement on whether the hosting plan includes updates
Your web provider may well have patched everything already, but with sites like these I wouldn’t assume it.
If you can't name the person responsible for updating PHP on your website's server, finding out is your first job.
Usually it's one email to your web provider.
Questions to ask your web provider
Here’s what I’d send to whoever looks after your website (feel free to copy it):
- Has the server running our website been updated for PHP2Shell, and when?
- Which version of PHP is our site running? The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or a patched build from your host.
- If we're on PHP 8.1 or older, what's the plan to move to a supported version?
- Have you checked the site for signs of compromise from before the update?
- Are WordPress, the plugins and the theme up to date, and have unused plugins been removed?
- Who has admin access to the site and the hosting account, and is MFA turned on?
- Where are our backups kept, and when was a restore last tested?
You can check the PHP version yourself if you have admin access to WordPress. Go to Tools, then Site Health, open the Info tab and expand the Server section. Before you panic about an old-looking number, some hosts patch older versions without changing the version number, so ask your host what it means.
If you do need to move to a newer version of PHP, have it tested on a copy of the site first. Old themes and plugins are usually the reason a site got stuck on an old version in the first place.
There's a third one
On 23 October, PHP disclosed a third flaw, CVE-2026-115560. It only affects sites with an unusual configuration, and there's no fix yet - PHP will include one in its next regular release. In the meantime PHP recommends a settings change (turning off a feature called session upload progress), so ask your web provider to confirm it's been applied.
Want someone to ask these questions for you? Book a consultation with Lucidity →
Checking your other apps and devices
The same thinking applies to everything else on the list above. I’d work through it in this order:
-
1
Make a list. Write down every website, portal, web app and device with a web admin page, and who looks after each one.
-
2
Ask each provider for a status. You're after a simple answer for each: patched, worked around, or not affected, and the date.
-
3
Check devices against vendor advisories. Firewalls, NAS boxes and similar devices need a firmware update from the manufacturer, so check their security advisories and apply updates as they're released. Statuses are changing daily, which is why I haven't listed them here.
-
4
Take it off the internet if it can't be patched. That's the advice from NCSC and agencies overseas. For a NAS or an admin page, that usually means switching off remote access and using a VPN instead.
-
5
Look for signs of compromise. If something sat unpatched for days, have someone review it for unfamiliar admin accounts and files, and change any passwords and keys stored on the server.
Wrapping up
PHP2Shell is a serious flaw in software most business owners have never heard of, and it sits underneath a big chunk of the internet. The fixes are out, and the cloud providers you already pay are doing most of the work. Your job is to find anything that’s slipped through, and in my experience that’s usually the website someone built for you years ago.
The situation is still developing, and what I’ve written here is accurate as at 29 October 2026. I’ll update it if anything significant changes.
If you’re not sure where to start, or you’d like us to have the conversation with your web provider for you, get in touch. Any questions, let me know.
For more information:
Top 10 questions asked about PHP2Shell
Quick answers to common questions about PHP2Shell and what it means for your business.
1. What is PHP2Shell?
PHP2Shell is the name given to two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619), fixed on 22 October 2026 (NZ time). They let an attacker run their own code on an affected web server without logging in.
2. What is PHP and does my business use it?
PHP is the programming language that builds web pages on the server for around 69% of websites. If you have a WordPress website, an online shop, a web portal or a hosting control panel, you very likely use it.
3. Is my WordPress website affected by PHP2Shell?
WordPress runs on PHP, so your site is exposed if the server underneath it runs an unpatched version of PHP. Ask your host or web provider whether the server has been updated, and when.
4. Will updating WordPress fix PHP2Shell?
No. The flaw is in PHP, the software underneath WordPress, so PHP itself has to be updated on the server. Keeping WordPress, plugins and themes up to date is still important.
5. How do I check which version of PHP my website runs?
In WordPress, go to Tools, then Site Health, open the Info tab and expand the Server section. Some hosts patch older versions without changing the number, so confirm with your host.
6. Which PHP versions fix PHP2Shell?
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older no longer get official updates, so sites on those versions need a patched build from their host or an upgrade to a supported version.
7. Do I need to do anything about cloud services like Microsoft 365?
No. Cloud services you subscribe to are patched by the provider, so there's nothing for you to install. It still pays to check anything you or a third party manage, such as a website server, virtual server or web portal.
8. Is PHP2Shell being actively exploited?
NCSC says it is aware of reports of active exploitation, and attackers began scanning for vulnerable servers within hours of the fixes. As at 29 October 2026, Wordfence was not aware of any WordPress site compromised through PHP2Shell.
9. Can my firewall or NAS be affected by PHP2Shell?
Yes, some firewalls, NAS boxes and other devices with a web admin page run PHP. Check the manufacturer's security advisories, apply firmware updates, and turn off internet access to the admin page if you can't patch it.
10. What do I need to do about PHP2Shell now?
Find out who is responsible for updating PHP on your website's server and ask them to confirm it's been patched, then check your other web apps and devices. Book a consultation with Lucidity.
Ready to get PHP2Shell sorted?
Talk to Lucidity and we'll help you work out what runs PHP in your business, who's responsible for it and what to check.
