PHP2Shell: what the big PHP leak means for your website, and when it's time to renew

On 20 October 2026, details of two critical security flaws in PHP leaked, a day before the fix was due out. By the next morning the first attacks were already running. Several Dutch websites, including Tweakers, the Tweede Kamer and the national cyber security centre NCSC, went offline as a precaution.

PHP is the programming language behind WordPress, Joomla, Drupal, PrestaShop and a large share of the web. TechCrunch put it at around 70 percent. So if you have a website, there's a good chance this is about you.

This article explains what happened in plain terms, what to check today, and why it's a good moment to ask whether your site should still be built the way it is.

What happened?

The two flaws are known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They're in PHP itself, not in a plugin or a theme. PHP's security team rated both 9.2 out of 10. The serious part: an attacker can run their own code on your server with a single request, without a password and without anyone clicking on anything.

The timeline, according to the security firms Sansec and Patchstack and to TechCrunch:

• August 2026: researchers at Calif and Wiz find the flaws and report them to PHP. The fixes are prepared quietly, so hosting companies can patch first.
• 20 October: the details leak, before the planned publication.
• 21 October, 07:43 UTC: Cloudflare sees the first attacks, hours before the fix is public.
• 21 October, 14:00 UTC: PHP releases the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Amazon advised looking for signs of attacks as early as 17 October. Wiz says every PHP version back to 5.4 is affected by at least one of the two flaws.

Is my website affected?

If your website runs on PHP and the server hasn't been updated since 21 October, yes. It doesn't matter how well your WordPress is maintained: the problem is underneath it. Wiz demonstrated the attack on a fully up-to-date WordPress installation.

The riskiest sites are the ones nobody looks after any more:

• the site that was built five years ago and has been running "by itself" ever since;
• shared hosting where you can't choose or see the PHP version;
• servers on PHP 8.1 or older. Those versions get no official updates any more. Some hosting companies and Linux distributions have backported the fix themselves, but not all of them.

What should I do today?

1. Ask your hosting company or web agency which PHP version your site runs on, and whether the PHP2Shell fix is installed. A concrete answer is good. "We'll look into it" isn't.
2. On PHP 8.1 or older: ask whether your hosting has backported the fix. If not, upgrading is no longer optional.
3. Don't install "fix" plugins or code snippets from forums. The flaw is in PHP itself, and only an update of PHP fixes it.
4. If you weren't patched for days, treat the server as possibly compromised: change your passwords and check for administrator accounts you don't recognise.

Why this is a moment to rethink your website

PHP2Shell will be patched and forgotten. The next critical flaw will come anyway, in PHP or somewhere else. The real question is not "am I patched now?" but "how much can go wrong with my site, and who keeps it up to date?"

That depends a lot on how your site is built.

Plain HTML. A website of static files. No code runs on the server when someone visits, no database, no login. There's simply nothing for a flaw like PHP2Shell to attack. For a business card site, a portfolio or a landing page that rarely changes, it's the fastest and safest option there is. The downside: changing text means a small job for your web agency, unless we add a simple editor.

Next.js. A modern framework that turns most pages into ready-made files in advance and serves them from a global network. There's no PHP and no WordPress admin panel in it. It suits sites with more pages, multiple languages, a blog or a booking module. Let's be honest: Next.js isn't immune either. Last December the React2Shell flaw needed an urgent update too. The difference is that the attack surface is much smaller, and that there's no pile of plugins from different makers to keep up to date.

WordPress, done properly. WordPress isn't bad, and we still build it when a client wants to edit a lot themselves. But then it needs managed hosting that patches PHP within hours, few plugins, and someone who checks it every month. A WordPress site without maintenance is exactly the site PHP2Shell was made for.

When is rebuilding worth it?

Not always. A well-maintained WordPress site on good hosting can carry on for years. Rebuilding becomes worth considering when:

• your site runs on PHP 8.1 or older and an upgrade breaks themes or plugins;
• you hardly ever change the content yourself, but still pay for and maintain a whole CMS;
• your site is slow, and you've been planning a new design anyway;
• nobody can tell you who maintains your server.

In those cases, a site in plain HTML or Next.js is often cheaper to keep running than to keep patching the old one.

Want to know where your website stands? Book the call. We'll check your PHP version and hosting, and tell you honestly whether maintaining it, moving it or rebuilding it is the smartest step.

Sources

• Patchstack: Major security alert, PHP vulnerable to critical RCE, attacks ongoing
• Sansec: PHP2Shell, PHP RCE (CVE-2026-109618, CVE-2026-109619)
• TechCrunch: PHP-ocalypse, how two critical web bugs almost broke the internet
• The Hacker News: PHP2Shell, two critical PHP RCE flaws trigger emergency security alert
• watchTowr: CVE-2026-109618 FAQ

Noah WinkelmanSelva Digital

Builds websites and the systems behind them for small businesses in Spain and the Netherlands. Writes down the things clients ask twice.