PHP2Shell: Why Today’s PHP Security Alert Hit Close to Home

When a major security vulnerability makes the headlines, it can feel a long way removed from the websites we use every day. Today’s PHP security alert brought it much closer to home.

I have personally hosted hundreds of websites that use PHP, and I too was faced with the practical challenge of mitigations and patching. Behind every security advisory are people responsible for keeping websites running, protecting information and working out what needs attention first.

When you have that responsibility, “update immediately” carries considerable weight.

What has happened?

Two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been disclosed in PHP. The issues have become known collectively as PHP2Shell. BleepingComputer’s coverage provides an overview of the emergency release.

PHP is software that runs behind the scenes on web servers. It helps websites process information and generate the pages visitors see.

The vulnerabilities can allow an attacker to execute code remotely without logging in. Depending on the access available to the affected process, that could put website files, configuration and data at risk. PHP’s developers are urging users to update immediately. Official PHP security advisory

The reality of hosting hundreds of websites

Having hosted hundreds of PHP websites myself, I know that a security alert quickly becomes a question of responsibility.

Each website may represent someone’s business, income or years of work. Visitors see the pages and services they depend on; the hosting software underneath is usually invisible until something goes wrong.

I was faced with mitigations and patching too. It is the practical side of technology that rarely features in a product launch or gadget review, but it matters enormously.

At that scale, you also need to establish which systems require attention and check that websites continue to function after changes. A patch being available is an essential first step. Getting it deployed and verifying the result is the work that follows.

Mitigation buys time, but patching matters

PHP’s security team has published temporary measures to reduce exposure to particular attack paths. However, it explicitly warns that these measures do not make an installation safe. Updating is the complete solution.

The fixed releases announced today are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Administrators using distribution packages should check their vendor’s security updates, which may include backported fixes. PHP release and mitigation guidance

What should website owners do?

If someone else manages your hosting, contact them and ask whether the PHP installation serving your website has received the relevant security fixes.

Updating your website’s content management system and plugins remains good maintenance, but PHP itself also needs attention at the hosting level.

The UK’s National Cyber Security Centre has urged organisations to identify affected systems and apply updates. Where immediate remediation is not feasible, it advises considering taking the system offline until it can be fully mitigated. NCSC guidance

For me, today’s alert is a reminder of how much ongoing work sits behind a functioning website. Having hosted hundreds of PHP sites and faced these mitigation and patching decisions myself, I understand why administrators are treating this with urgency.

If you own a website, now is a good time to speak to whoever looks after its hosting and get confirmation that the necessary action has been taken.