PHP2Shell: What Happened and What We Did About It

On October 21, 2026, the team behind PHP released emergency fixes for two serious security vulnerabilities, known together as PHP2Shell. Here's what happened, what the risk was, and what it means for your website.

The short version: A serious security vulnerability was found in PHP, the software behind about 7 in 10 websites. We checked with our vendors and patched our entire hosting stack the same day. If we host your website, this vulnerability is patched on it, and you don't need to do anything.

What PHP is

PHP is software that runs on a web server. When someone visits a website, PHP builds the page they see. WordPress is written in PHP, and so are many other website systems.

PHP is everywhere. W3Techs, which tracks the software websites run on, finds PHP on 69.3% of the websites where it can tell what the server uses. That's about 7 in 10.

What happened

Security researchers found two vulnerabilities in the core of PHP itself, labeled CVE-2026-109618 and CVE-2026-109619. Details leaked on October 20, so PHP moved its fix up a day and released patched versions on October 21. Both vulnerabilities are rated 9.2 out of 10 for severity.

What the threat was

The vulnerabilities let an attacker run their own code on a web server just by sending it specially crafted requests. They didn't need a password or a login. Running code on the server is the same as taking control of it.

The problem was in PHP, not in a plugin or a theme. So it reached almost every server that uses PHP to deliver web pages, whatever website was running on it. The vulnerable code had been in PHP for more than a decade.

Security firms saw attackers trying the vulnerabilities within a day, according to The Hacker News. The federal Cybersecurity and Infrastructure Security Agency (CISA) urged everyone running PHP to patch immediately.

What we did

We work with our vendors to apply patches as they become available. In this case, because of the severity, we applied the patch the same day to our entire hosting stack. Every server we host websites on was updated to the fixed version of PHP on October 21.

This was a server-level issue, and server-level issues are ours to handle. We patched it for every website we host, whatever hosting plan you're on.

What you need to do

If we host your website, nothing.

PHP2Shell is one of many threats a website can face, though. Others could live in the website itself, like an out-of-date plugin or a weak password. Our Website Care and Website Protect plans keep WordPress and its plugins updated, with regular security checks and daily backups. If you'd like to know where your website stands, ask us and we'll take a look.

If other companies run software for your business, it's fair to ask them how they handled this patch too.