PHP2Shell: A Critical Security Flaw Puts Millions of Websites at Risk. Pressific Clients Are Protected.

Imagine waking up to find your business website has been hacked. Your homepage has been replaced, customer enquiries are being intercepted, and visitors are being sent to fraudulent websites.

Now imagine finding out that your website's code wasn't even the problem.

That's the scenario behind PHP2Shell, a pair of critical security flaws in PHP, one of the most widely used web programming languages in the world. They've triggered urgent warnings from cyber security agencies and technology companies around the globe, and both carry a severity rating of 9.2 out of 10.

On a vulnerable server, attackers could potentially steal information, change website files, install malicious software or take control of the web applications running there.

Why should website owners care?

You don't need to understand programming to understand how serious this is.

PHP powers millions of websites, including those built on WordPress, one of the world's most popular website platforms. And the worrying part is that a website doesn't need to be complicated to be exposed. Even a simple site that uses PHP for a contact form, a header or a footer could be vulnerable if its server runs an affected version.

This time the problem isn't a weak password, an outdated WordPress plugin or a developer's mistake. The weakness sits deeper, inside the programming language itself. According to the PHP project, an attacker doesn't even need to log in to exploit it.

If it's exploited, attackers could potentially:

• Access or steal information stored on the server.
• Replace website content or redirect visitors to fraudulent pages.
• Intercept customer enquiries or sensitive form submissions.
• Install malicious files or use a compromised website to spread malware.
• Disrupt services, or reach further into hosting systems that aren't properly isolated.

These are potential consequences. They aren't evidence that every PHP website has been compromised.

PHP2Shell at a glance

A leak, attacks and a race to patch

The discovery prompted urgent warnings internationally, including from the UK's National Cyber Security Centre (NCSC). Security researchers and major technology providers raced to protect vulnerable infrastructure, and some organisations took websites and online services offline as a precaution.

Things became particularly urgent when details of the flaws leaked before the planned public disclosure. The CVE numbers were circulating on 20 October, and the PHP project brought its security release forward by a day in response.

Attackers didn't wait. Amazon's threat intelligence team reported an exploitation attempt against its honeypot network on 17 October, four days before disclosure, and Cloudflare and other security firms saw attack traffic too.

The emergency PHP security updates were released on 21 October 2026.

How Pressific clients were protected

We don't rely on a single safeguard. PHP2Shell was met by two layers, and then by a check that nothing had got through.

Layer one: Cloudflare's Web Application Firewall. The large majority of the websites we manage sit behind Cloudflare, and its firewall is part of our managed hosting security. Cloudflare rolled out PHP2Shell protections at 03:02 UTC on 21 October, about nine hours before public disclosure. Free plans were covered automatically, paid plans through Cloudflare's managed rules, and every plan got a default block for high-confidence attack signatures. These rules are designed to spot and block known exploitation attempts.

Layer two: patched PHP. A firewall buys time, but it isn't a fix. On 22 October we installed the official PHP security releases on every server we manage, and we confirmed that the managed websites hosted on other providers' servers are running fixed versions too.

Then we checked. Because the flaws were public before anyone could patch, we inspected every server for signs of compromise. We found none.

The result: Pressific-managed websites are protected against these known vulnerabilities, and our managed hosting clients don't need to do anything.

We don't just give you backup tools. We take responsibility.

Every website owner should ask one simple question: if my website were compromised tomorrow, who would actually put it right?

Many hosting services hand you backup software and leave the restoring to you. That's not how Pressific works.

Our managed hosting includes guaranteed backups and hands-on recovery. If something goes wrong, we take responsibility for restoring your website. And if we can't restore it from backup, we'll rebuild it for free.

You don't need to become a server administrator, learn complicated restore procedures or work out how to recover your business website on your own. That's what managed hosting should mean.

What should you do if Pressific doesn't manage your website?

If you're with another hosting provider, don't assume your site is protected just because it seems to be working normally. Take these steps:

1. Contact your hosting provider. Ask whether the PHP2Shell security updates have been applied.
2. Confirm your PHP version is supported and maintained. Updating WordPress alone won't fix this vulnerability.
3. Check your security protection. A properly configured web application firewall adds an important layer of defence, but it doesn't replace patching.
4. Make sure your backups actually work. A backup nobody has tested, or nobody knows how to restore, may not help much in an emergency.
5. Ask who's responsible for recovery. Find out whether your host will restore your website or leave you to deal with it.

Don't wait for something to go wrong before you find out.

How to check which PHP version your site runs

In WordPress, go to Tools > Site Health > Info and open the Server section. Your PHP version is listed there.

One thing to watch: many hosts use the PHP packages that come with the server's operating system, and those vendors often backport security fixes without changing the main version number. Ubuntu 24.04, for example, reports PHP 8.3.6, and its fixed package is 8.3.6-0ubuntu0.24.04.13. If your site shows an older-looking version, don't assume the worst, but don't assume it's fine either. Ask your host to confirm the fix has been backported.

The technical details: what exactly is PHP2Shell?

PHP2Shell is two critical vulnerabilities in the way PHP manages memory and handles errors inside the PHP runtime.

CVE-2026-109618: out-of-memory corruption

An attacker can push PHP into running out of memory while some internal data is only partly set up. When PHP cleans up afterwards, it can treat that unfinished data as if it were valid.

CVE-2026-109619: use-after-free from stale state

Under certain error conditions, PHP keeps references to memory that's freed when the request ends. A later request handled by the same process can follow those stale references, which can expose sensitive data or corrupt memory. The PHP project lists memory disclosure as a confirmed impact.

Both are rated 9.2 using CVSS v4.0 and can potentially lead to remote code execution by an attacker who isn't logged in.

Crucially, the flaws are in the PHP runtime itself, not in a particular WordPress theme, plugin or application. The PHP project says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk on mod_php. The vulnerable code goes back as far as PHP 5.4.

The PHP project released fixed versions on 21 October 2026: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some operating system vendors supply equivalent backported fixes. There's no official fixed release for PHP 8.1 or older: versions 7.4 to 8.1 only get source-code patches from the PHP security team, and 5.4 to 7.3 get nothing at all. If you're on PHP 8.2, plan your next upgrade too, as php.net lists it as reaching end of life on 31 December 2026.

Cloudflare's firewall rules for PHP2Shell are also the first to use its new "full transaction" detection, which looks at both the incoming request and the server's response to spot a successful attack. That's real defence in depth, but the PHP security update is still essential.

Security isn't something you should have to think about every morning

PHP2Shell is a reminder that website security goes far beyond changing passwords or updating WordPress plugins. It covers the servers, programming languages, network infrastructure, monitoring, backups and recovery procedures that keep a business online. If you'd like to see how your own setup measures up, our WordPress security checklist is a good place to start.

At Pressific, we believe website owners should be able to focus on running their businesses, knowing the technical responsibilities are taken care of.

We don't just host websites. We look after them. Discover Pressific managed hosting.

Sources and further reading

• PHP security announcement and releases (php.net)
• Critical security issue affecting PHP (UK National Cyber Security Centre)
• Cloudflare deploys protections against php2shell vulnerability (Cloudflare)
• php2shell: frequently asked questions (Tenable)
• PHP: the three letters that shut down sites all over the internet today (The Verge)

Published 22 October 2026. This advisory describes the PHP2Shell vulnerabilities and Pressific's managed hosting protections as of publication.