Have you heard about PHP2Shell and you’re not sure your sites are safe? Here’s what happened, what we did hour by hour, and what you can check on your own.<\/p>\n\n\n\n
On 21 October PHP fixed two flaws in its core, CVE-2026-109618 and CVE-2026-109619, named PHP2Shell<\/strong>. They let anyone run code on the server remotely, without logging in. PHP rated them 9.2 out of 10; watchTowr, which analysed them, puts them at 10.<\/p>\n\n\n\n The fixed versions were released at 15:50 Italian time (13:50 UTC):<\/p>\n\n\n\n For 8.1 and older there is no official release<\/strong>: there are only source-code fixes for 7.4, 8.0 and 8.1, which someone has to compile and install.<\/p>\n\n\n\n The flaws were found by Wiz, with the help of AI models. The same day some Wikipedia services and several government websites in the Netherlands and Finland were taken offline as a precaution.<\/p>\n\n\n\n Times are Italian time.<\/p>\n\n\n\n The time between a patch being published and the first attack attempts is now a matter of hours: for PHP2Shell the first ones arrived right after the announcement. Attackers read the fix, work out what was closed, and try it on the servers that haven’t installed it yet.<\/p>\n\n\n\n And finding a flaw costs less and less. Wiz says that work which used to take a team months was done by one researcher, with AI, in a week. If the time to find a flaw gets shorter, the time to update has to get shorter too.<\/p>\n\n\n\n If a site runs on PHP 7.4, 8.0 or 8.1, today there is no official package to install. The application firewall blocks the known attack request, but nobody knows the variants in advance. The only complete fix is moving to a supported version, 8.2 or later.<\/p>\n\n\n\n We know it isn’t always simple: an abandoned plugin, a theme written years ago, a management system nobody wants to touch. That’s exactly why it pays to do it now, calmly, rather than at the next flaw.<\/p>\n\n\n\n Ask them. There are three questions:<\/p>\n\n\n\n If the answer takes days, or never comes, you already have your answer.<\/p>\n\n\n\n Have you already updated PHP on your servers? If you need a hand, write to us: we’ll check it together, no strings attached<\/strong>. Or choose a hosting like ours, where updates are our job.<\/p>\n\n\n\n Read more:<\/p>\n\n\n\n\n
What we did, hour by hour<\/h2>\n\n\n\n
\n
Why speed matters<\/h2>\n\n\n\n
Sites on old PHP<\/h2>\n\n\n\n
How to check your site<\/h2>\n\n\n\n
\n
php -v<\/code> gives you the command-line version. The site may use a different one, so check point 1 too.<\/li>\n\n\n\nIf your host hasn’t told you anything<\/h2>\n\n\n\n
\n