What Is PHP, and Does the PHP2Shell Flaw Affect Your Website?

In late October 2026, a pair of critical vulnerabilities in PHP, now known as PHP2Shell, was disclosed. They let attackers take control of a PHP web server remotely, and cybersecurity agencies in several countries urged organizations to update immediately.

Here is a plain-language summary for business owners: what PHP is, what happened, and what to do next.

What is PHP?

PHP is a server-side programming language. It builds web pages, fetches data and runs back-office systems. It is one of the most widely used languages on the web: according to W3Techs, about 69% of websites whose server-side language is known use PHP.

Many familiar sites run on PHP, including those built with WordPress, Drupal and Joomla, as well as hosting control panels such as cPanel and Plesk.

What happened

Date	Event
23 Oct 2026	PHP issued further guidance to temporarily disable session.upload_progress
21 Oct 2026	PHP shipped emergency fixed releases; attacks were reported in the wild
20 Oct 2026	Details leaked ahead of the planned announcement
17 Oct 2026	Amazon Threat Intelligence saw the first exploitation attempt, four days before disclosure

The two flaws are CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 (CVSS v4.0).

How serious is it?

No login needed. An attacker can run code on the server remotely, effectively taking control of it.
Every PHP installation serving web requests is at risk, whatever its setup, and configuration changes alone do not fully protect you.
It is being exploited. CERT-EU and the UK's NCSC went as far as advising organizations to take sites offline while waiting to patch, and warned about backdoors.
Old versions have no official fix. PHP 7.4, 8.0 and 8.1 have only source-code patches, and 7.3 and older have none.

If your website uses PHP, here's what to do

Check whether your site uses PHP. Ask your developer or hosting provider. A WordPress site almost certainly does.
Update to a fixed version now: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on your branch.
Restart PHP after updating, or the fix may not take effect.
Upgrade old versions. If you're still on PHP 8.1 or older, it's time to move to a supported version.
If you can't update right away, restrict internet access to the server first.
Look for signs of intrusion, since attacks began before the fix was released.

This is one reason websites need ongoing care. Sites that nobody updates, or that run on long-outdated technology, are the most exposed in events like this

Websites built by Celestial Code are not affected by this flaw

Celestial Code Co., Ltd. does not use PHP to build websites. We build our server-side systems with Node.js (see our Tech Stack), so the websites we have developed for clients are not affected by PHP2Shell. Our clients don't need to worry about this vulnerability, and we continue to look after and update every client's system.

If you have another website or system that runs on PHP and you're not sure it's safe, send us the details. Our team will review it for free and send you a report with our recommendations. Get in touch

Sources

What Is PHP, and Does the PHP2Shell Flaw Affect Your Website?

Ready to build something great?