On October 21, 2026, the PHP development team released security updates for two critical vulnerabilities that could allow attackers to execute code on affected servers without logging in. The vulnerabilities, known as PHP2Shell, may affect websites and applications running on vulnerable PHP versions.
For businesses that depend on their websites for enquiries, bookings, sales, or customer accounts, this is an important security update that should not be ignored.
What Does the PHP2Shell Vulnerability Mean for Your Website?
PHP is the software that runs many business websites and web applications. WordPress, CodeIgniter, and custom PHP web applications all depend on it.
The PHP2Shell vulnerabilities could allow an attacker to exploit an unpatched PHP environment and execute code without valid login credentials. Depending on the server's configuration and permissions, this could expose sensitive information or allow changes to website files.
The PHP development team has released security fixes. The priority for website owners is to confirm that their live hosting environment is protected.
Does Updating WordPress or Application Code Fix the Problem?
Not by itself.
Updating WordPress, plugins, or application code is important, but these updates do not necessarily update the PHP software running on your server.
Your hosting environment needs to run a fixed PHP release or have an appropriate security patch provided by its vendor. Your developer or hosting provider can help verify this and ensure the website continues to work after the update.
Which PHP Versions Have Security Fixes?
The PHP team has published the following fixed releases for supported branches:
| PHP version branch | Fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
If your website uses an older PHP version, ask your hosting provider whether a security patch is available for that specific environment or whether an upgrade is required. Some hosting and operating-system vendors provide their own security fixes for older versions.
These version numbers are the releases addressing this specific alert, not a guarantee that a website has no other security issues.
What Should Your Business Do Now?
There are four sensible steps to take:
- Confirm your PHP version. Ask your hosting provider or development team which version your live website uses.
- Arrange the appropriate security update. Have the responsible technical team apply the correct fix for your hosting environment.
- Check that your website still works. Test important features such as contact forms, customer logins, bookings, payments, and integrations after the update.
- Investigate any signs of compromise. If you suspect unauthorised activity, ask your technical team to investigate. Updating PHP alone does not remove malware or reverse an earlier breach.
If you cannot apply the update immediately, contact your hosting provider for guidance on temporary risk reduction. Temporary protections should not replace the required security fix.
Need Help With Your PHP Website?
Security updates can be more complicated when a business relies on an existing website, third-party integrations, or custom functionality. The update needs to be handled carefully so that security improves without unnecessarily disrupting day-to-day operations.
At TheFoxLab, we develop and maintain custom PHP applications, WordPress websites, and API integrations. We help businesses with website maintenance, technical troubleshooting, and ongoing development support.
If you need help reviewing your website's PHP environment or planning a safe update, contact TheFoxLab to discuss your requirements.
Official Security References
- PHP security announcement — October 21, 2026
- PHP source security advisory — CVE-2026-109618
- PHP source security advisory — CVE-2026-109619
- Canadian Centre for Cyber Security advisory
This article provides general information about the security alert. The appropriate update depends on your PHP version and hosting environment. Consult your hosting provider or development team for environment-specific guidance.