PHP2Shell: What the PHP Security Flaws Mean for Your Website

A serious PHP security alert is a reminder that your website can need urgent attention even when it looks perfectly normal. Known as PHP2Shell, the issue concerns two critical vulnerabilities in software that runs behind many business websites.

For business owners, the practical question is simple: who is checking whether your website is affected, and who will apply the fix?

Advisory checked: 21 October 2026, before the scheduled PHP security release. This is a developing issue; use the official sources listed below for current patch information.

What is PHP2Shell, in plain English?

PHP is software on your hosting server that helps your website do things, such as process forms, load content and handle customer accounts. WordPress and many custom websites rely on it.

PHP2Shell is the name being used for two reported PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Researchers describe them as remote code execution flaws. In plain English, a successful attack could make an affected server run instructions supplied by an attacker.

Think of your website as a shop. You may have a good lock on the front door, but a fault in the building itself could create another way in. Updating a website's plugins does not necessarily repair the underlying server software.

The PHP team has rated both vulnerabilities critical, at 9.2 out of 10. At the time of checking, it had not yet published the definitive affected and fixed versions. A PHP-based website needs checking, but that does not mean every website has been compromised. PHP's official announcement is listed in the sources below.

How did the issue come to light?

According to Huntress's account, information about the vulnerabilities leaked on Hacker News on 20 October, ahead of a planned coordinated disclosure. The post was removed, but screenshots circulated.

Researchers at watchTowr confirmed the vulnerabilities were real and said they believed they had reproduced one of them. PHP then announced an emergency security release scheduled for 21 October at 14:00 UTC, which is 1 am on 22 October in Sydney.

This explains how the issue became public. The reports available when this article was prepared did not provide a complete account of the original discovery, so it would be premature to credit Huntress or another organisation with finding both flaws.

What could happen if an affected website is left unpatched?

The concern is what an attacker could do with the access gained. Depending on the server's permissions and configuration, possible consequences include:

• Stolen information: access to customer details, enquiries or other data available to the website.
• Altered pages: malicious content, unexpected redirects or changes to information customers rely on.
• Disruption: an unavailable website, interrupted bookings or lost orders while the problem is investigated.
• Recovery costs: time spent investigating, removing malicious files and rebuilding confidence in the site.

These are potential consequences of a successful compromise, not evidence that they have happened to your business. A normal-looking homepage is also not proof that everything behind it is secure.

What should your hosting provider be doing?

Your provider should identify which PHP installations your sites use, follow the official security release, and apply the relevant fixed packages as they become available through their supported software provider. They should also make sure the running website processes use the updated software and check important functions afterwards.

Temporary protections can help reduce exposure while that work happens. CloudLinux reported that Imunify360 ruleset 8.83 blocks a publicly circulating attack pattern. It also described disabling PHP's session upload-progress feature as an optional partial measure. Neither is a complete fix. CloudLinux says the underlying issue extends beyond that upload path and reports observing attempts matching the pattern. The CloudLinux advisory is listed below.

Disabling that particular feature normally leaves file uploads working, but uploaders that depend on PHP's session-based progress tracking can lose their progress display or cancellation functionality. That is why configuration changes need checking against the actual website.

You do not need to run server commands yourself. Ask your provider:

• Have you checked which of my websites and PHP installations need attention?
• What temporary protections are in place, and what are their limitations?
• When will the vendor-confirmed PHP fix be installed and verified?
• Are backups available, and will you investigate any signs of compromise?

Why this matters when choosing website hosting

A hosting invoice tells you where your website lives. Your service agreement should also tell you who takes responsibility when urgent maintenance is needed.

At Mr Digital, our managed website hosting brings hosting, updates, security management, backups and developer support together within an agreed scope. We support existing WordPress websites as well as custom builds, so you can get help without automatically committing to a rebuild.

Our website maintenance service includes practical checks on the parts your business depends on, such as enquiry forms, bookings and checkout. When a server change is needed, understanding the website itself helps us assess the impact and resolve compatibility problems.

No provider can promise that a website will never face a security issue. The value is having someone responsible for assessing alerts, managing the response and explaining what still needs to happen.

Not sure who is looking after your website security?

Send us your website address and tell us who currently handles your hosting and updates. We can review the setup and recommend what needs attention, whether that is ongoing maintenance, managed hosting or a specific repair.

Contact Mr Digital about your website's security and maintenance.

Sources and further reading

• PHP security announcement: https://www.php.net/archive/2026.php#2026-10-20-1
• Huntress report: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
• watchTowr FAQ: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
• CloudLinux advisory: https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
• PHP session upload-progress documentation: https://www.php.net/manual/en/session.upload-progress.php