Have you heard about PHP2Shell and you’re not sure your sites are safe? Here’s what happened, what we did hour by hour, and what you can check on your own.
What happened on 21 October
On 21 October PHP fixed two flaws in its core, CVE-2026-109618 and CVE-2026-109619, named PHP2Shell. They let anyone run code on the server remotely, without logging in. PHP rated them 9.2 out of 10; watchTowr, which analysed them, puts them at 10.
The fixed versions were released at 15:50 Italian time (13:50 UTC):
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
For 8.1 and older there is no official release: there are only source-code fixes for 7.4, 8.0 and 8.1, which someone has to compile and install.
The flaws were found by Wiz, with the help of AI models. The same day some Wikipedia services and several government websites in the Netherlands and Finland were taken offline as a precaution.
What we did, hour by hour
Times are Italian time.
- 21 October, 11:08. Imunify360, the security suite on our Plesk servers, gets a rule for its web application firewall that blocks the known attack request. It’s protection while waiting for the patch, not a fix.
- 15:50. The fixed PHP versions are released.
- A few minutes later. On the Plesk servers PHP updates itself: our licences include automatic updates, and we keep them on.
- About two hours later. On the VPS we manage, we update PHP manually, with our updater: a script that checks backups, versions and services.
Why speed matters
The time between a patch being published and the first attack attempts is now a matter of hours: for PHP2Shell the first ones arrived right after the announcement. Attackers read the fix, work out what was closed, and try it on the servers that haven’t installed it yet.
And finding a flaw costs less and less. Wiz says that work which used to take a team months was done by one researcher, with AI, in a week. If the time to find a flaw gets shorter, the time to update has to get shorter too.
Sites on old PHP
If a site runs on PHP 7.4, 8.0 or 8.1, today there is no official package to install. The application firewall blocks the known attack request, but nobody knows the variants in advance. The only complete fix is moving to a supported version, 8.2 or later.
We know it isn’t always simple: an abandoned plugin, a theme written years ago, a management system nobody wants to touch. That’s exactly why it pays to do it now, calmly, rather than at the next flaw.
How to check your site
- Your site’s PHP version. In Plesk you’ll find it in the domain’s PHP settings. In WordPress go to Tools → Site Health → Info → Server.
- The number after the second dot. An 8.3 must be at least 8.3.36, an 8.4 at least 8.4.27, and so on with the list above.
- If you have SSH access,
php -vgives you the command-line version. The site may use a different one, so check point 1 too. - WordPress, themes and plugins up to date. The flaw is in PHP, but an old site usually has more than one open door.
If your host hasn’t told you anything
Ask them. There are three questions:
- when did you update PHP, and on which versions?
- what are you doing for sites on PHP 8.1 or older?
- is there an application firewall with rules updated to 21 October?
If the answer takes days, or never comes, you already have your answer.
Have you already updated PHP on your servers? If you need a hand, write to us: we’ll check it together, no strings attached. Or choose a hosting like ours, where updates are our job.
Read more:
Contacts
"*" indicates required fields
Your business, “Without Worries”
It’s time to take back control of your time. Focus on acquiring new customers, marketing strategies, and developing excellent code. At machines, performance, and IT security, we’ve got it covered.
Request today your free 30-day trial and unlock the potential of your agency!
