PHP2Shell: what happened this week and what to do if your website runs on PHP

What happened

PHP is the programming language behind most websites. WordPress, WooCommerce, Joomla, Drupal and many custom sites run on it. Wiz Research, a security company, found serious bugs in the core of PHP itself, not in any plugin. They reported them to the PHP security team in August 2026 and named them PHP2Shell.

On 20 October the PHP project warned that a critical security release was coming. On 21 October it published the fixes and told everyone to update now. Both flaws are rated 9.2 out of 10 for severity.

In simple terms, the bugs are in how PHP cleans up after certain errors, for example when a request uses too much memory. An attacker can send specially made requests that leave PHP in a broken state and then use that to run their own code on the server. They do not need a password or an account on your site. Wiz says the bugs can also leak server memory, which may contain passwords and API keys.

Wiz also says it used AI tools to help find the bugs and build working attacks. That is part of why the news spread so fast: it showed that serious flaws in old, widely used software can now be found much faster than before.

Why this one is serious

Three things made security teams across Europe react quickly:

• It affects almost every PHP site. The PHP advisory says all PHP installations that serve web pages are at risk. Wiz says every PHP version from the last decade is affected.
• Attacks started fast. According to The Hacker News, Cloudflare saw attack attempts within 45 minutes of the disclosure, and by early 22 October they had reached millions. Some security firms reported attempts to install botnet malware. Others say a reliable attack is harder to build than it first looked.
• Europe issued a joint warning. On 21 October the European Commission, ENISA, CERT-EU, Europol and the network of national CSIRTs published a joint statement asking organisations to patch, starting with anything facing the internet.

Which versions are safe

According to the CERT-EU advisory, these are the fixed versions:

• PHP 8.5.12 or newer
• PHP 8.4.27 or newer
• PHP 8.3.36 or newer
• PHP 8.2.35 or newer

PHP 8.1, 8.0, 7.4 and older are end of life. The PHP project does not release official updates for them. It did publish minimal fixes for people who build PHP themselves, and some hosting companies and Linux vendors provide their own patched builds. Also note that PHP 8.2 reaches end of life on 31 December 2026, so plan to move to 8.3 or newer soon anyway.

A third issue, two days later

On 23 October PHP published a short advisory about another flaw. It only affects sites with an unusual setup, and PHP says this is "unlikely in practice". It is not fixed by the 21 October releases. PHP's advice is to switch off a setting called session upload progress until the next regular update. This is something your host or developer can do in minutes, and it was already one of the recommended temporary measures for the first two bugs.

What to do today

1. Check your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. You will see the PHP version there. Most hosting control panels also show it.
2. Ask your host. Send a short message: "Have you applied the 21 October PHP security fixes to my server? Which PHP version am I on?" Good hosts patched on the day. For example, SiteGround says it added protection before the release and then applied the fixes on all its servers.
3. Upgrade if you are on an old version. If your site still runs on PHP 7.4, 8.0 or 8.1, this is the push to move. Test on a staging copy first if you can, because old plugins sometimes break on newer PHP.
4. Take a backup. Make sure you have a recent backup of files and database stored somewhere other than the server.
5. Keep an eye on the site. Watch for new admin users you did not create, unknown files, strange redirects, or a sudden drop in traffic in Search Console and GA4.

What this means for businesses in Cyprus and Greece

Many small business sites here are built on WordPress and hosted on cheap shared plans that nobody has looked at in years. I see it often: the site works, so nobody touches it, and it is still on an old PHP version from when it was built.

If you run an e-shop, the risk is bigger. A hacked shop can leak customer details, show fake payment pages, or get flagged by Google with a warning that scares away visitors. Under GDPR, a breach that exposes personal data may also have to be reported.

The good news is that the fix is usually quick. For most sites it is a version switch in the hosting panel, or one message to the host. The hard part is knowing that you need to do it. Now you know.

Questions people ask

Want help with this? Book a free 30-minute call.

Sources

1. Security advisory: Critical remote code execution vulnerabilities, update now, PHP, October 2026
2. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, Wiz Research, October 2026
3. Critical Vulnerabilities in PHP, CERT-EU, October 2026
4. Joint statement on critical PHP vulnerabilities, ENISA, October 2026
5. PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches, The Hacker News, October 2026
6. SiteGround moves early to protect customers ahead of critical PHP security release, SiteGround, October 2026