If you have heard the name "php2shell" over the last week, here is the short version from our service desk: two serious flaws in PHP, the software running behind a huge share of the world's websites, let an attacker take over a web server without ever logging in. CISA now confirms attackers are using them. If your business has a website, a customer portal or an online store, this one is worth five minutes of your time.
What Happened
On October 21, 2026, CISA (the federal Cybersecurity and Infrastructure Security Agency) issued an alert urging organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. At that point no attacks had been seen yet, but public reporting already pointed to proof of concept code being available. On October 26, CISA added both flaws to its Known Exploited Vulnerabilities catalog, the list of flaws attackers are actively using, and gave federal agencies until October 29 to fix them.
Why It Matters to a Small Business
PHP is the programming language behind WordPress, most small business websites, many online stores and plenty of the web based apps businesses use every day. You may never have heard of it, and that is exactly the problem: PHP is often built into other software, so you can be running it without knowing.
These flaws affect PHP wherever it serves web pages, however it is set up (Apache, PHP-FPM, LiteSpeed and others). An attacker who gets in could deface your site, steal what customers type into your forms, plant malware for your visitors, or use the server as a foothold into the rest of your network.
Five Things to Check This Week
- Ask whoever hosts your website one direct question. Your web designer, hosting company or IT provider should be able to confirm your PHP is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. Those are the patched releases.
- Watch for older versions. PHP 8.1 and older no longer get official updates. If your site runs on one of them, it needs an upgrade, not just a patch. CISA's advice is to take PHP systems that cannot be updated offline until they are fixed.
- Remember the forgotten systems. Old marketing sites, staging copies, intranet tools and vendor devices with a web login page can all run PHP. Anything reachable from the internet comes first.
- Update WordPress, plugins and themes, and delete plugins you no longer use. Patching PHP does not fix plugin flaws, and updating plugins does not fix PHP.
- Confirm you have a recent, tested backup of your website so a clean copy can be restored quickly if something goes wrong.
Signs Something Is Wrong
Ask whoever manages your server to keep an eye out for unusual activity, such as the web server suddenly launching command shells or downloading tools, admin accounts nobody created, or pages that change without anyone touching them. A web application firewall can buy some time, but it is not a substitute for patching.
How We Handle Alerts Like This
Every morning our team checks CISA's list of actively exploited vulnerabilities against the software actually running in the environments we manage. When something like php2shell lands, we confirm who is affected, get it patched, and reach out directly to any client who needs to take action. Most of the time our clients never have to think about it, which is exactly how it should be.
One honest caveat: if your website is hosted by a web designer or hosting company rather than by us, it sits outside what we patch. That makes this a good week for a quick conversation with them.
Not sure who looks after your website, or want a second set of eyes? Give us a call, or request a free external security scan and we will walk you through what we find on a short call.
Bri leads service delivery at PC Techware: the service desk, technical team and the standards behind every client environment.
