PHP vulnerability (php2shell): what business owners should do

The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. Combined, they let someone run their own code remotely on a website's server without logging in. This is remote code execution, the most severe category. They received a CVSS v4 score of 9,2 out of 10, according to Tenable.

For a business owner, an intruder could alter the site, extract customer database records, redirect the shop to a fake payment page or send spam from the server. The flaw is in PHP itself, not a plugin or theme, explaining its broad reach.

Probably, if your website uses PHP and is not yet updated. Help Net Security reports that all PHP versions from version 5 are affected, including:

• every WordPress site and WooCommerce shop;
• Joomla, Drupal, PrestaShop, Magento and most traditional CMS platforms;
• many custom Laravel or Symfony applications.

Sites entirely using something else, such as Shopify, Wix, Squarespace or static websites, are unaffected. If unsure, use the free Marketing Scan PHP check for an indication in ten seconds. It makes an ordinary homepage request and never attempts an exploit.

Three steps, in order:

1. Contact your developer or hosting provider. Ask: 'Does our site use PHP, and is it updated to 8.2.35, 8.3.36, 8.4.27 or 8.5.12?'
2. Request confirmation including the version. 'We are looking into it' is not an answer. You want the version number.
3. Using PHP 8.1 or earlier? No security update will arrive. Plan an upgrade to at least 8.2 and ask whether a firewall rule can protect the site meanwhile.

Large Belgian and Dutch shared hosts usually handle PHP updates centrally. Ask anyway: obtain written confirmation.

On 21 October, Belgium's Centre for Cybersecurity (CCB) reported no confirmed successful attacks in Belgium. Cloudflare had already seen initial attempts and deployed additional firewall rules, reports VRT NWS. Dutch websites also went offline as a precaution; see the NOS live blog.

Experience with similarly large vulnerabilities shows attackers automatically scan the internet within days. Waiting for attack reports is often too late.

Partly. A web firewall blocks known patterns and buys time. But Patchstack and Cloudflare agree that updating is the only complete solution. Attackers adapt to evade firewall rules.

Treat a firewall as temporarily locking the door, not repairing it. Existing Cloudflare users probably have those rules enabled. Ask your developer to confirm and proceed with the update regardless.

Most small businesses need not, provided the update happens today or tomorrow. Large organisations handling sensitive data, including schools and hospitals, went offline because they must inspect hundreds of systems.

If you handle sensitive information such as payments outside an external payment provider, medical or legal data, and your developer cannot update for several days, temporary removal or maintenance mode is reasonable.