On 21 October 2026, we updated all our servers running PHP 7.4 and later in record time, responding to the critical vulnerabilities known as PHP2Shell. The update concerns a layer behind the scenes of websites, ecommerce stores and business applications: the environment that runs their code.
PHP logo by Colin Viebrock / PHP.net, CC BY-SA 4.0. Cover with added background, distributed under the same licence.
PHP2Shell: what happened and why the alert matters
PHP2Shell refers to the security issue involving two PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both are rated critical, with a CVSS 4.0 score of 9.2 out of 10. Under vulnerable conditions, they can allow an unauthenticated attacker to execute code on a server.
The flaws concern internal memory management and request state. Their significance does not depend on how a website looks or whether it contains a particular page: they affect the PHP engine handling web requests. The exploitation conditions vary with the runtime environment and the application.
The PHP project published its security advisory on 21 October 2026, urging users to update immediately. This requires an operational response: waiting for a website redesign does not address a flaw in the software running it.
Why it matters for WordPress, ecommerce and business software
Website security discussions often focus on WordPress themes and plugins. Those updates matter, but they cover only part of the system. PHP itself, the web server and the hosting environment also need maintenance.
The same principle applies to PHP-based ecommerce platforms, private portals and custom applications. Alongside clear content and useful features, a business website needs technical care for the infrastructure beneath it.
PHP2Shell illustrates why updating a CMS and updating its server are complementary tasks. A vulnerability in the PHP engine must be addressed at that level; updating a plugin or changing an administration password is not a substitute.
Our response on 21 October: every server running PHP 7.4 and later updated
We prioritised this alert and completed the updates across all our servers running PHP 7.4 and later on 21 October. The rapid response covered the affected server environments, beyond maintenance of individual applications.
For customers who entrust us with their hosting, the benefit is practical: a technical alert becomes work on the environment hosting their website or software. They have a technical contact without having to work out alone whether an issue concerns the CMS, an extension or the runtime.
We are referring specifically to security updates addressing PHP2Shell. A timely patch addresses the known vulnerabilities it targets; ongoing service security also depends on the application, configuration and subsequent updates.
Which fixes were made available?
For supported PHP branches, the fixed releases identified in the 21 October advisory are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distributions and vendors may also integrate fixes into their own packages while retaining different version numbering.
When reviewing a hosting environment, a version number alone may therefore not tell the full story. The software’s distribution channel and the vendor’s security information also matter.
PHP 7.4 and older branches: a patch does not restore regular support
Our reference to PHP 7.4 needs context. PHP 7.4 is outside the PHP project’s regular support lifecycle. For this emergency, minimal source backports were made available for PHP 7.4, 8.0 and 8.1; some vendors also offer their own extended maintenance arrangements.
Applying a fix to an older branch does not mean it resumes receiving all regular updates. Websites and applications depending on older environments should still plan a move to maintained versions, checking compatibility with code, themes, modules and integrations.
Managed hosting and maintenance: work beyond the homepage
A business website should represent the company clearly, be usable and help visitors find information. Keeping it useful over time also requires less visible work: updates, attention to dependencies and a response to security advisories.
This is part of the value of managed hosting, maintenance and technical support. The relationship with a technical provider continues after launch, helping the project respond to changes in its operating environment.
The same care matters when taking over an existing website or custom business application. Before choosing an intervention, the application, its components and the infrastructure must be understood as connected layers with distinct responsibilities and update requirements.
Is your website hosted elsewhere?
If your website uses PHP and is hosted by another provider, ask for confirmation that the fixes for CVE-2026-109618 and CVE-2026-109619 have been applied. If it depends on an older branch, ask how that version is maintained and what an upgrade would involve.
This does not automatically require changing platforms. It requires a clear technical picture. Based in Borgomanero, Italy, we help businesses look after websites, ecommerce platforms and applications, including assessing systems built by other developers.
Technical sources and further reading
- PHP.net: security advisory and updates of 21 October 2026.
- PHP advisory CVE-2026-109618: out-of-memory handling.
- PHP advisory CVE-2026-109619: internal request state.
Official advisories may be updated with further guidance. They should also be consulted when assessing work after this article’s publication date.
