PHP2Shell: What the Critical PHP Security Flaws Mean for Websites

A major cyber security issue affecting PHP has put businesses, developers and governments on alert.

Two critical vulnerabilities have been discovered in PHP, one of the most widely used programming languages behind websites and web applications.

The flaws are serious because they could potentially allow an attacker to execute code on a vulnerable server without needing to log in first.

PHP has now released emergency security updates, while the UK's National Cyber Security Centre has urged organisations using PHP to identify affected systems and update them as quickly as possible.

For businesses, this incident is another reminder that website security goes much deeper than the pages customers see.

What Happened?

The vulnerabilities are tracked as:

CVE-2026-109618
CVE-2026-109619

Both have been classed as critical security vulnerabilities and can potentially allow unauthenticated remote code execution.

That sounds extremely technical, but the basic idea is fairly simple.

A vulnerable PHP server could, under certain conditions, be made to execute commands sent by someone who should not have access to it.

The attacker would not necessarily need an existing account or password.

PHP rated the vulnerabilities at 9.2 out of 10 under CVSS 4.0, placing them firmly in the critical category.

Why Does PHP Matter So Much?

PHP is not some obscure programming language sitting behind a handful of websites.

It is one of the technologies that has powered the web for decades.

It can be found behind:

• WordPress websites

• WooCommerce stores

• Magento and other ecommerce systems

• Drupal

• Joomla

• Custom business applications

• Booking systems

• Membership platforms

• Internal tools

• APIs

When someone visits a PHP-powered website, PHP generally runs on the server behind the scenes.

It might retrieve products from a database, process a customer login, handle a form submission or generate the page being sent to the visitor's browser.

That means vulnerabilities inside PHP itself can potentially affect a huge variety of websites.

This Isn't Just a WordPress Vulnerability

This distinction is important.

When businesses hear about website security problems, they often assume somebody has discovered another vulnerable WordPress plugin.

That isn't what has happened here.

The vulnerabilities are within PHP itself.

WordPress happens to run on PHP, as does WooCommerce, but PHP is also used by many other platforms and completely custom websites.

So simply saying:

“We don't use WordPress.”

doesn't necessarily mean a business is unaffected.

The more important question is:

“Does anything in our infrastructure run PHP?”

Ecommerce Businesses Should Pay Particular Attention

For ecommerce brands, incidents like this matter because online stores hold and process significant amounts of information.

Depending on the platform, an ecommerce environment might connect to:

• Customer accounts

• Order information

• Inventory systems

• Warehouse software

• Shipping providers

• Marketing platforms

• Payment services

• CRM systems

• Analytics platforms

• Internal APIs

A vulnerability in the technology underneath the website therefore has the potential to affect much more than the homepage or product pages.

For example, WooCommerce runs on WordPress, and WordPress runs on PHP.

That doesn't mean every WooCommerce store is vulnerable or compromised.

But it does mean businesses using PHP-based ecommerce systems should know which PHP version their hosting environment is running and who is responsible for updating it.

What Has PHP Done About the Vulnerabilities?

PHP released security updates on 21 October 2026.

The fixed releases include:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

PHP has strongly encouraged users to update immediately and has stated that there are no complete mitigations that can safely replace updating the affected software.

That last point matters.

This isn't something website owners should assume can simply be solved by changing a setting or installing another security plugin.

The underlying PHP environment itself needs to be updated.

What Is the UK Government Saying?

The UK's National Cyber Security Centre has issued guidance to organisations running PHP.

The NCSC recommends identifying systems running PHP across an organisation's infrastructure, prioritising internet-facing systems and applying the available security updates.

It also recommends monitoring internet-facing PHP systems for suspicious activity and checking third-party products that may include PHP internally.

That final point is particularly interesting.

A business may be using PHP without even realising it.

Software products can include technologies such as PHP underneath the interface customers or employees actually use.

This is why understanding your technology stack matters.

The Bigger Question: Do You Know What Runs Your Website?

Incidents like this expose a common problem in web development.

Most businesses know what their website looks like.

Many know what platform it uses.

But considerably fewer know exactly what technology sits underneath it.

A business owner might know:

“Our website is WordPress.”

But they may not know:

• Which PHP version it uses

• Who maintains that version

• Whether the server is receiving security updates

• Which plugins are still supported

• Which libraries the website depends on

• Whether old code is still running

• Who is responsible when a critical vulnerability appears

That's not necessarily something every business owner needs to manage personally.

But someone needs to know.

Website Maintenance Is More Than Updating Content

There is sometimes a misconception that website maintenance means changing banners, uploading products and fixing the occasional broken page.

Technical maintenance is just as important.

A modern website may depend on:

• Programming languages

• Frameworks

• Libraries

• Plugins

• Databases

• Server software

• APIs

• Cloud infrastructure

• Third-party services

Every one of those technologies evolves.

Security vulnerabilities are discovered.

Versions reach end of support.

Dependencies become outdated.

That's why websites cannot realistically be treated as something that is built once and then ignored indefinitely.

Legacy Websites Can Create Additional Problems

Older websites can be particularly difficult when incidents like this occur.

Imagine a business has been running the same website for six years.

It still works.

Customers can place orders.

Nothing appears broken.

But underneath the surface, the website may rely on old software and outdated dependencies.

Then a serious vulnerability appears.

Updating PHP might be necessary, but an old theme, plugin or custom integration may no longer work properly with the newer version.

Suddenly, something that should be a straightforward security update becomes a much larger development project.

Regular maintenance helps prevent this situation.

Keeping systems reasonably current makes emergency security updates much easier to deal with.

What Should Website Owners Do?

The first thing is not to panic.

The discovery of a critical vulnerability does not mean every website using PHP has automatically been hacked.

But it does mean businesses should establish whether they are affected.

If your website uses PHP, speak to whoever manages your technical infrastructure.

That could be:

• Your hosting provider

• Your internal development team

• Your IT provider

• Your web agency

You want to establish:

Which PHP version are we running?

Has the security update been applied?

Do any third-party systems we use include PHP?

Who is responsible for maintaining this going forward?

For businesses using managed hosting, the provider may handle part or all of the PHP update process.

But it's still worth verifying rather than assuming.

Why Security Needs to Be Part of Web Development

Web agencies are increasingly dealing with systems that are far more complex than traditional websites.

An ecommerce store today might connect to:

• Shopify or WooCommerce

• Klaviyo

• ERP software

• Warehouse systems

• Payment providers

• CRMs

• Analytics tools

• Advertising platforms

• Custom APIs

That means web development and cyber security are becoming increasingly connected.

Developers don't need to turn every website project into a penetration test.

But security needs to be considered throughout development.

When adding a new integration, we should be asking:

What does this system have access to?

When installing a dependency:

Is it actively maintained?

When deploying an application:

Who is responsible for updating it?

And when handing over a website:

What happens after launch?

Those questions are becoming just as important as whether the website looks good.

Cyber Security Is Also Business Risk

A website security incident isn't purely a developer problem.

It can quickly become a business problem.

Depending on the situation, an incident could affect:

• Customer trust

• Website availability

• Sales

• Customer information

• Internal operations

• Brand reputation

• Regulatory obligations

This is particularly important for ecommerce businesses because the website is often directly responsible for generating revenue.

If the store becomes unavailable, the business doesn't simply lose website traffic.

It can lose sales.

What Web Agencies Can Learn From This

For agencies, incidents like this are an important reminder that responsibilities need to be clear.

Who maintains the website after launch?

Who monitors security updates?

Who controls the hosting environment?

Who updates dependencies?

Who does the client contact if a critical vulnerability is announced?

These questions should not first be answered during a cyber incident.

They should be part of the relationship between agencies and their clients from the beginning.

How Devignify Approaches Web Security

At Devignify Studio, we see web development as more than simply producing what users see on the screen.

Behind every modern digital experience is a technology stack.

There are frameworks, APIs, platforms, integrations, databases and third-party services all working together.

And every technical decision can introduce both opportunities and risks.

That is why businesses increasingly need development partners who understand not only how to build digital products, but how those products need to be maintained once they're live.

Security shouldn't suddenly become important when a vulnerability reaches the news.

It should be part of the conversation from the start.

The PHP security vulnerabilities are significant because of just how widely PHP is used.

But there is also a much broader lesson here.

Your website is only as maintainable as the technology underneath it.

Businesses should know what their websites depend on, who is responsible for maintaining those systems and what happens when an urgent security update is released.

You don't need to understand every line of code running your website.

But you should know who does.

Because launching a website is only the beginning.

Keeping the technology underneath it secure is an ongoing responsibility.