PHP2Shell: an update from Faciotech
What happened
Earlier this week the PHP project disclosed two critical security flaws in PHP itself, the programming language behind most of the web. They are tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell". Both are rated 9.2 out of 10 (CVSS v4.0). On a server running an affected version, an attacker can run their own code from the outside, with no password and no account.
The reach is what makes this so serious. W3Techs reports that PHP runs 69.3% of the websites whose server language it can identify. That includes WordPress, Drupal and Joomla, so if your site is built on one of them, this affects you. Every PHP version since 5.4, which came out in 2012, has at least one of the two flaws.
The disclosure did not go to plan. On 20 October the CVE numbers began circulating on online forums, and one of the security firms that found the flaws published a demonstration video by mistake. The video was deleted quickly, but copies spread across social media. The PHP project brought its release forward, and the fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) came out on 21 October.
The last 48 hours
For system administrators everywhere, the past two days have been relentless. Since the fixes came out, admins have worked around the clock to find every server running PHP, install the update, restart services and confirm the fix is active. Here at Faciotech I have colleagues who haven't slept in two days. That is not an exaggeration.
You may have seen some of this work yourself. Malwarebytes warned that people may find websites in maintenance mode while their administrators install the update, and in Canada the federal government took some of its own websites offline as a precaution. If a site you use was briefly down this week, someone was probably busy protecting it. A maintenance page on its own does not mean a site was hacked.
The risk
Any website on an unpatched version of PHP can be taken over, with no login needed. An attacker who gets in can steal customer data, deface the site, plant malware that targets its visitors, or use the server to reach other systems.
This is no longer theoretical. Amazon's threat intelligence team recorded an attempt to exploit PHP2Shell on 17 October, four days before the flaws were made public. The security firm watchTowr saw attacks on both flaws on 21 October, the day the fix came out. The US Cybersecurity and Infrastructure Security Agency (CISA) "strongly urges organizations to immediately patch", and the Canadian Centre for Cyber Security has issued its own alert (AL26-026).
Older sites have a harder problem. PHP 8.1 and older no longer get fixes from the PHP project, so there is no official patch for them. CISA advises taking servers on those versions offline if they cannot be updated promptly. For many older sites the real fix is a move to a supported version of PHP. Even PHP 8.2 gets its last fixes at the end of this year.
Updating WordPress or your plugins is not enough. The flaws are in PHP itself, so the fix has to be made on the server.
The picture is still changing. On 23 October PHP disclosed another flaw, CVE-2026-115560. It only affects sites set up in an unusual way, PHP rates it an unlikely risk, and there is no patch yet. PHP's advice is to switch off a setting called session upload progress. On our servers that setting has been off since 22 October.
Where Faciotech stands
We updated PHP on our own hosting servers on 22 October. Every PHP version that serves websites there is now a fixed release, and we have confirmed the fix is active. We are now confirming the same for client websites hosted on our partners' servers, and checking client websites for any sign that someone got in before the fix was applied. Patching closes the door, but it doesn't tell you whether someone already walked through it. We will keep going until every client site is confirmed safe, and we will contact you directly if anything needs your attention.
What we're asking of you
If you have a website, hosted with us or anywhere else, ask your hosting or web provider how they are handling PHP2Shell. Three questions to ask:
- Has PHP on my server been updated to a fixed version?
- Has my site been checked for signs that someone got in?
- If my site runs an older version of PHP, what is the plan to move it to a supported one?
A good provider will answer these clearly and quickly. If yours can't, push harder or get help.
We will share more updates as things develop. Thank you to everyone in the sysadmin and security community who has worked nonstop this week. Most people never see this work, and it keeps a large part of the internet running safely.
Urbanus Azupogo
Faciotech
