PHP2Shell: what a 5 to 150 person firm should ask its web host this week

1. What happened

On 21 October 2026, PHP released emergency fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The flaws allow unauthenticated remote code execution. PHP rated them CVSS v4.0 9.2, not 10. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. (Tenable; The Hacker News)

Amazon, watchTowr and Cloudflare have reported exploitation attempts. As of 21 October, no confirmed successful compromise had been reported. (Tenable; Help Net Security)

2. Why this matters to a small firm

Your website, client portal or WordPress site may run on PHP. A web host or outside developer often looks after that runtime, and your firm may not know which version is running.

Client-facing sites support important interactions, including contact forms, portals and document uploads. It is reasonable to ask the people managing them for a clear update.

3. The lesson: check the runtime, not just the website

The website and the PHP runtime behind it are different things. A well-built site can still rely on an older runtime running on someone else’s server.

Updating the PHP runtime is not the whole job. PHP-FPM or Apache must also be restarted. If the host uses Linux distribution packages, the displayed version number may stay old. Ask them to check the changelog for the CVE fix. (Tenable)

PHP 8.1 and older receive no official fix release. PHP 5.4 to 7.3 are end-of-life with no fix. (Tenable)

4. Copy and send these questions today

Start with a 30-second check. Our free PHP2Shell check reads the PHP version banner your site already sends every visitor, sends no active probes, and tells you what to raise with your host. Only check domains you own or manage: https://aiopensec.com/php2shell?utm_source=blog

Then, whatever the result, ask your web host or developer:

Which PHP version runs each of our websites and client-facing services?

Have you applied the PHP emergency fixes released on 21 October for CVE-2026-109618 and CVE-2026-109619?

Which fixed version are we running: 8.5.12, 8.4.27, 8.3.36 or 8.2.35?

Did you restart PHP-FPM or Apache after updating?

If you use a Linux distribution package, does its changelog show the CVE fix?

Are any of our sites still using PHP 8.1 or older, including end-of-life versions 5.4 to 7.3? What is the plan to move them?

5. Where AIOpenSec helps

PHP2Shell is a reminder that the software behind a website is easy to lose track of, especially when someone else runs it. Four ways we help:

Check your site now. Our free PHP2Shell check reads the PHP version banner your site already sends every visitor and tells you whether it looks patched, unpatched, end-of-life or hidden. Passive only, nothing is sent to your site beyond a normal page visit: https://aiopensec.com/php2shell?utm_source=blog
See what you expose. The free CyberFit Score looks at your domain from the outside, showing open services, exposed subdomains, expiring certificates and leaked credentials, ranked so you know what to raise with your host first. No agent to install: https://aiopensec.com/score?utm_source=blog
Track the machines you run. Where your firm runs its own servers and laptops, CyberFit reports vulnerable software and patching status in one place, and A-Monk explains each finding in plain English.
Keep the evidence. When a client or insurer asks what you did about a critical flaw, CyberFit gives you a dated record of findings and patches to show them.

Not sure what your website runs on? Book 30 minutes with VJ and we will go through it with you: https://aiopensec.com/contact?utm_source=blog

6. What to do next

Run the free PHP2Shell check, then send the questions to your host this week and keep their response.