On October 21, 2026, PHP's developers released fixes for two critical security flaws, CVE-2026-109618 and CVE-2026-109619, now being called "PHP2Shell." Both are rated critical, 9.2 out of 10. Exploit code is public, attacks are already underway, and some governments and large organizations took websites offline as a precaution while they patched.
Most small businesses don't know whether they run PHP. Many do.
What the flaws allow
PHP is the programming language behind WordPress and a large share of the web, including many hosting control panels and customer portals. On an unpatched server, these flaws can let anyone on the internet run their own code on the server without logging in. That can mean a defaced or offline website, stolen data, or a site quietly changed to send visitors to phishing pages or malware.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are no longer supported by the PHP project. Some Linux distributions and hosting providers maintain their own patched packages for older versions, so ask your provider exactly what they've done rather than assuming.
Is your business exposed?
You may be running PHP if you have:
- A WordPress website, or a site on typical shared hosting
- A client or customer portal where people upload documents or fill in applications
- A hosting control panel such as cPanel
- An old marketing site, landing page or microsite nobody has touched in years
- A network device or appliance with a built-in web admin page
Dealerships should include inventory and credit application sites. Tax offices should include document upload portals and appointment tools.
Three questions to ask your web host or IT provider today
- Which of our systems run PHP, and which version? Include anything that isn't your main website.
- Have they been updated to a fixed version, and when? If something can't be updated right away, ask whether it can be taken offline or protected by a web application firewall until it is. Temporary workarounds are stop-gaps only; updating, or taking the system offline, is the real fix.
- Have you checked for signs of compromise? For example: new or changed files in the website's folders, unfamiliar admin accounts, unusual processes or outbound connections, and web shells (hidden pages attackers use to control a server). Patching closes the door, but it doesn't remove an attacker who got in before the patch.
Ask for the answers in writing. That record is useful evidence later.
Why this is a Safeguards Rule issue
The FTC Safeguards Rule expects you to oversee the service providers that handle customer information, including web hosts and IT companies, and to have a written plan for security incidents. If a compromised system exposed customer information, your incident response plan applies. If unencrypted information on 500 or more consumers was acquired without authorization, the FTC must be notified no later than 30 days after discovery.
If you don't have a list of your service providers, or you're not sure who would answer these questions, start there. That gap is worth closing whether or not PHP2Shell affects you.
The short version
- Find out where PHP runs in your business, including the forgotten sites.
- Get confirmation in writing that each system is patched, protected or offline.
- If anything looks wrong, follow your incident response plan, and don't wait.
Not sure where to start? Get in touch and we'll help you work through it, or get the free checklist to see where your program stands.
Facts as of the evening of October 21, 2026, from public reporting; this post may be updated as details change. Check your vendors' advisories for current details. References: Krebs on Security, The Register, The Record, 16 CFR Part 314. General guidance, not legal advice.