PHP2SHELL: Urgent PHP Vulnerabilities Put Millions of Websites at Risk

PHP2SHELL: Urgent PHP Vulnerabilities Put Millions of Websites at Risk

The PHP community has issued an emergency security update after details emerged of two critical vulnerabilities that could allow attackers to execute malicious code on vulnerable web servers. For businesses running WordPress websites, ecommerce platforms, customer portals, or bespoke web applications, this is a reminder that keeping hosting infrastructure patched and monitored is more important than ever.

What Has Happened?

The PHP security team announced emergency security updates to address two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities have been assigned a severity score of 9.2 under CVSS v4.0, making them among the most serious security issues disclosed this year.

According to researchers from watchTowr, the vulnerabilities are believed to be remote code execution (RCE) flaws affecting multiple PHP versions, potentially including PHP 5, PHP 7 and PHP 8 installations. Remote code execution vulnerabilities allow attackers to run commands directly on a server, potentially leading to website compromise, malware installation, data theft, or complete server takeover.

Adding to the urgency, Dane Knecht, CTO of Cloudflare, confirmed that exploitation attempts are already being observed in the wild.

Why This Matters for Businesses

PHP powers a vast proportion of the internet, including content management systems, ecommerce platforms, customer portals and bespoke web applications. As a result, a critical PHP vulnerability has the potential to impact organisations of all sizes.

For businesses, a successful compromise could result in:

• Website defacement
• Customer data exposure
• SEO spam injection
• Malware distribution
• Email abuse and blacklisting
• Service disruption and downtime

The incident serves as another example of why proactive cybersecurity measures are essential, rather than relying solely on reactive fixes after a breach occurs.

What Should Website Owners Do?

If your website is hosted on a managed platform, your hosting provider should already be assessing and deploying the necessary updates.

However, website owners should still take the following precautions:

Confirm Hosting Updates Have Been Applied

Speak with your hosting provider and ask whether PHP security updates relating to CVE-2026-109618 and CVE-2026-109619 have been deployed.

Review Website Security

Check for signs of compromise, including:

• Unexpected administrator accounts
• Unauthorised content changes
• Suspicious outgoing emails
• New files appearing within website directories
• Unusual server resource usage

Ensure You Have Reliable Backups

Maintaining both local and off-site backups can significantly reduce downtime and data loss should a security incident occur.

Learn more about our managed IT support and resilience services:

Managed IT Support

Temporary Mitigations Are Not Enough

While some temporary workarounds and web application firewall (WAF) rules have been suggested within the security community, PHP developers have made it clear that these should only be regarded as short-term mitigations.

The official recommendation is straightforward: apply the vendor security updates as soon as they become available.

This reinforces a key cybersecurity principle: layered security is valuable, but critical vulnerabilities must still be patched promptly.

Key Lessons for Businesses

Outdated Software Creates Risk

Many organisations continue running unsupported or end-of-life software because it still appears to function correctly. Unfortunately, attackers actively target known vulnerabilities in older systems.

Lack of Monitoring Delays Detection

Without effective monitoring and alerting, compromises can remain undetected for weeks or even months, increasing both the potential damage and recovery cost.

Regular Security Reviews Matter

Organisations should regularly review their websites, plugins, themes and server infrastructure to reduce their attack surface and identify vulnerable components.

For guidance on improving your organisation’s cybersecurity posture, visit:

Cyber Security Services

How System Force Can Help

At System Force, we help businesses reduce their exposure to emerging cyber threats through proactive security management and expert IT support.

Our services include:

• Managed IT Support
• Cyber Security Services
• Vulnerability Management
• Microsoft 365 Security
• Backup and Disaster Recovery
• Cyber Essentials Preparation
• Security Monitoring and Response

Whether you’re operating a small business website or managing a complex IT estate, rapid patch deployment and continuous monitoring are essential components of a resilient security strategy.

Useful resources:

• Cyber Security Services
• Managed IT Support
• System Force Blog
• Contact System Force

Final Thoughts

The disclosure of CVE-2026-109618 and CVE-2026-109619 demonstrates how quickly a critical security issue can move from confidential disclosure to active exploitation. The best defence remains a combination of prompt patching, proactive monitoring, tested backups and a robust cybersecurity strategy.

Businesses should treat this as an opportunity to review their hosting environment, confirm updates have been applied, and ensure they have appropriate safeguards in place before attackers can exploit vulnerable systems.