In October, two critical vulnerabilities in PHP were disclosed under the shared name PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both have a CVSS score of 9.2 out of 10. They let an attacker send a specially crafted request to a server and run their own code there – no user account or password needed.
The first attack attempts were seen even before the fixes came out, and attackers have been scanning the internet for vulnerable servers ever since. This is not a theoretical threat.
Who is affected?
A large part of the web runs on PHP, including WordPress, WooCommerce and many other content management systems. Every PHP version older than the patched releases is at risk, whatever plugins or theme the site uses, because the flaw is in PHP itself.
Which versions are patched?
On 21 October PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official fix, so a site on an old version needs a build its host has patched, or a move to a newer PHP.
It’s a big problem: an estimated 70% or more of PHP installations already run on versions that are no longer supported.
What to do now
- Ask your host which PHP version your site runs on and whether it has been patched.
- If you’re on PHP 8.1 or older, plan a move to a supported version. In most cases your site gets faster too.
- If the update is delayed, your host can temporarily turn off the upload progress feature (session.upload_progress) that one of the flaws relies on.
- After updating, PHP and the web server need a restart – otherwise the old version keeps running.
For Caliora clients
If your site is hosted with Caliora and you have any questions, just get in touch. If it’s hosted elsewhere and you’re not sure it’s protected, write to us and we’ll look at it together.
