Action recommended · October 22, 2026
PHP2Shell: critical PHP flaws put business websites at risk
Two critical PHP flaws let attackers take over unpatched websites without logging in, and attacks have been seen. Here is who should pay attention and what to ask your web host or developer.
ezNet Solutions doesn’t manage or host websites. We’re flagging this because it’s serious and affects many business websites, so you know what to ask whoever manages yours.
What happened
On October 20–21, 2026, two critical flaws in PHP were made public, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). PHP is the programming language behind most of the web. On a website that hasn’t been fixed, an attacker can send one specially crafted request, without logging in, and take over the server. They can also read passwords and keys held in its memory.
The federal cybersecurity agency, CISA, has urged everyone to patch right away, and attacks have already been seen. On October 26, CISA added both flaws to its list of actively exploited vulnerabilities.
Who should pay attention
- Sites built on WordPress (including WooCommerce stores), Joomla, Drupal or Magento
- Sites on typical shared hosting or cPanel/Plesk hosting (GoDaddy, Bluehost, HostGator, InMotion, Namecheap and similar)
- Custom-built sites or online forms that a developer set up for you on a server
If your site is on a fully hosted platform such as Shopify, Squarespace or Wix, the platform maintains the servers. You don’t need to patch anything yourself, but it’s still a good idea to update your site passwords and turn on two-step login.
What to ask your web host or developer
- Is PHP updated to a fixed version? The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A Linux distribution’s patched build also counts. Ask for confirmation in writing.
- Are you on PHP 8.1 or older? Those versions no longer get official fixes. Plan an upgrade now.
- Are the site software, plugins and themes up to date? Remove plugins you don’t use.
- Is a web application firewall (WAF) turned on? Examples are Cloudflare, Sucuri, Wordfence or the host’s own WAF. A WAF helps while patching happens, but it isn’t a fix.
- Has anyone checked for signs of a break-in? That means admin users nobody recognizes, new or changed files, and unusual scheduled tasks.
- Will you change the passwords and keys stored on the site? That covers site admin, hosting and FTP logins, database passwords, and any payment, email or API keys the site uses. Do it after patching.
If something looks wrong
Ask your host or developer to take the site offline until it’s cleaned up and patched. If the website shares logins with your email or other business systems, let us know. We’ll help secure the accounts and devices we manage.