On 20 October 2026, details of two critical PHP vulnerabilities leaked online, before the official fix was even available. Within hours, "PHP2Shell" was making headlines in the specialist press worldwide.
Here is what happened, what it meant for your website, and how the ArtWhere team handled the situation.
What is PHP2Shell?
PHP is the programming language that powers a very large share of the world's websites: WordPress, Drupal and many online shops and intranets are built on it. When a vulnerability affects PHP itself, it is not a handful of sites that are at risk, but millions.
"PHP2Shell" actually refers to two separate vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. The PHP security team rated them 9.2 out of 10 for severity. They could allow an attacker, without any password, to run their own code on the server — in other words, to take control of it remotely.
To picture the risk: it is as if someone had found a master key capable of opening every building fitted with the same model of lock. However sturdy the door or good the alarm, the lock itself was the problem.
Why it was particularly serious
- A leak before the fix. Normally, a vulnerability is made public at the same time as its fix. Here, the details circulated first: for several hours, attackers knew as much as defenders, and no official update existed.
- A gigantic target. PHP runs on the majority of web servers. Attackers automate this kind of exploit to sweep the internet on a massive scale.
- Even the experts shut up shop. Several organisations, including cybersecurity centres such as the Dutch NCSC, took their own websites offline as a precaution while waiting for the fix. In Belgium, the CCB website was also unavailable.
Our response, hour by hour
At ArtWhere, we host and maintain our clients' websites. Their security is our responsibility, not theirs. Here is how the day unfolded.
| When | What we did |
|---|---|
| 21 October, 5 am | The whole team mobilised. Inventory of servers and PHP versions in use, heightened monitoring of all sites. |
| 21 October, 8 am | Even before the fix was released, we put in place the protective measures recommended by industry experts. From that point on, your sites were very largely protected. |
| 21 October, 3:45 pm | Official fix installed as a priority on every server we manage, followed by site-by-site checks. |
Throughout this period, our clients had nothing to do. No manual steps, no updates to run, no sites to take down. We stayed on the case until every site had been patched and checked.
Why updating WordPress was not enough
Many site owners had the right instinct and updated WordPress, their plugins or their theme. That is always useful, but it did not protect against PHP2Shell: the vulnerability lay in PHP itself, that is, in the engine that runs the site, managed at server level.
Only a PHP update fixed the problem. On 21 October, the PHP team released the following patched versions:
| PHP branch | Patched version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Older versions (PHP 8.1, 8.0, 7.x…) are no longer officially maintained. The PHP team released minimal fixes for some of them, but a site still running on such an old version remains a vulnerable target. This is one of the reasons we keep our clients' servers on up-to-date versions.
Your site is not managed by ArtWhere? Good practice
- Ask your hosting provider or your contractor whether PHP has been updated to one of the patched versions above, and when.
- Check your PHP version: it usually appears in your hosting dashboard, or in WordPress under Tools › Site Health › Info.
- If your site still runs on PHP 8.1 or earlier, plan a migration soon: this is no longer a matter of convenience, but of security.
- Watch for unusual signs: unknown new administrator accounts, modified files, suspicious redirects. If in doubt, call in a professional.
What this episode reminds us
Website security is not just about a strong password or an HTTPS certificate. It also relies on invisible building blocks (server, language, databases) that must be monitored and updated continuously. When a crisis like PHP2Shell breaks, the difference is made in hours.
That is precisely the role of a technical partner: keeping watch for you, reacting before you have to, and letting you carry on working with peace of mind while we take care of the rest.
A question about your website's security?
Our team is available to review your hosting and PHP versions with you.
info@artwhere.eu · +32 475 29 31 46
Sources
- php.net, official announcement of the security release of 21 October 2026
Get in touch
ArtWhere, digital innovation