PHP2Shell: The Flaw Behind Most Business Websites Is Already Under Attack

If your business website runs on WordPress, Joomla, Drupal or any other PHP software, it needs an update today. On October 21, 2026, the PHP project released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that researchers have nicknamed PHP2Shell. Both are rated critical (CVSS 9.2). Wiz Research, which found them, says they can let an attacker run code on a web server or read its memory without logging in, even when the website's own code is secure.

Why this one matters

PHP powers roughly 70% of the world's websites, according to Wiz, and every PHP version from the last decade, back to 5.4, is affected by at least one of the flaws. The memory leak is the quiet danger: it can expose passwords, login tokens, API keys and certificates stored on the server.

Attackers didn't wait. Details leaked online on October 20, before the patch. Amazon's threat intelligence team says it saw an exploit attempt as early as October 17, then saw proof-of-concept exploits used against its sensors within hours of the release, and now describes PHP2Shell as broadly exploited in the wild.

What to do this week

1. Find out where your website runs on PHP. That includes WordPress sites, online stores, booking or client portals, and vendor software that quietly uses PHP. Ask your web host or web designer if you're not sure.
2. Update PHP to a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Updating WordPress plugins is not enough, because the flaw is in PHP itself. On shared hosting, confirm with your host that they've patched.
3. Take old PHP offline. If a site runs an end-of-life PHP version that can't be updated, pull it off the internet until it can be rebuilt. Amazon says no setting change fully fixes both flaws.
4. Check for signs of a break-in. Have your IT provider review web server logs for unusual upload requests, unexpected files and unfamiliar processes on the server.
5. Change any passwords and keys stored on the server (database, payment, email and API keys) if the site was exposed before it was patched.

The bigger lesson: your website is part of your network. It needs the same update routine as your PCs and firewall.

Nice2GeekYou is based in San Antonio, serving all of Texas, and our managed IT plans support remote clients across the U.S. We keep servers and websites patched, watch logs and rotate exposed credentials. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: Wiz Research — PHP2Shell: critical RCE vulnerabilities in PHP (Oct 21, 2026); Huntress — Rapid Response: php2shell, leaked critical PHP vulnerabilities (Oct 20–21, 2026); AWS Security Blog — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure (Oct 21, 2026).