PHP2Shell FAQ: Can I ignore it? In plain English

OK, all us web-folk are blabbing on about PHP, and specifically PHP2Shell? But what does it even mean, does it affect you, and should you even care?

I’ll generalise a bit here, and keep things concise, simple, and human-readable. This is an article for the masses, certainly not a technical description.

This was an unprecedented worldwide cyber security issue.

What is PHP?

PHP is ‘software’ that runs on computers worldwide. It turns ‘web code’ into web pages that you see in your browser. PHP powers 70% of the websites on the Internet.

What were the PHP2Shell vulnerabilities?

Basically, two sequences of events that hackers can do to potentially gain full access to a web server, and the websites on it. It affected all versions of PHP dating back to 2012.

So, AI hacked PHP?

No, quite the opposite. AI tools helped discover vulnerabilities that had been there undiscovered for 14 years. This isn’t quite true, in that some people knew them to be there, but as they were difficult to exploit thought that a human would never do it. Of course, AIs are persistent, and can turn an unlikely sequence of events into a reality, they can do months of specialist research in days.

Why was this vulnerability different to others?

It affected 70% of the world, and potentially gave full access to any system running on it. As the issue was leaked early, the patches had to come out in a rush. It’s worth noting that by releasing a patch to website owners, you are also telling every hacker in the world where the security hole is at the same time. In the UK this was 3pm on 21st October 2026.

Was this in the news?

Yes, worldwide. It was front page on the BBC all day. https://www.bbc.co.uk/news/live/ckgel5xp2xv9t

Who took their site offline?

The UK government said to take any website that had not been patched offline immediately. Many governments and councils did this all around the world, along with large corporations, household names, and even the hacking groups themselves. Some are still offline over a week later. It affected the BBC, Nintendo, local councils… It affected 70% of the world.

Is it bad?

Yes. We’ll see this in the days, weeks and months to come.

Experts say there were no breaches…

That’s old news. There have been reports of this, for example, several U.S. government-affiliated sites have been affected. More worryingly is that a) these go unreported and b) hackers don’t cause damage immediately, they give themselves back door access to web systems and come back later. Millions of websites were being attacked within 15 minutes of patches being released. We’ve only seen the start of this.

Does the patch fix everything?

The patch was only for later versions (PHP 8.2 – 8.5). Any older versions (from PHP 5.4 – 8.1) had no official patch, and these represent 48% of the total. There were small groups of people who made patches, for free, for these earlier versions. A handful of people literally propped up a third of the Internet.

Is everything fixed?

Ha ha ha ha – noooooooooo. At the time of writing, only half of the later versions have been patched, and far far less of the older versions. Some web hosts have simply turned off servers running older code leaving customers stranded (yes, really). Others have forced updates to version 8.5 and applied patches. That sounds great, but not all websites run on all versions of PHP, and so websites are breaking. More and more hosts will follow suit as more sites get exploited.

Hey, we can’t just easily upgrade?

If everything is kept up to date, then likely, but in most cases, no. In reality people don’t update everything as they want to save money. Not all websites, not all plugins, and not all code runs on all versions of PHP. So PHP can be upgraded, but then the website may not work. Then you could get the website working, but the theme may break how it looks. So you fix that, and the next thing breaks. It’s easy, until it’s not.

Does it affect me? I have a simple brochure site

You’re far better off than a large shop or anyone handling secure data, absolutely. But if a hacker has full access to your website, there’s still a lot they can do. Hijack your email form, send emails from you to people, or blacklist your domain name so your emails always get put in junk. They can hijack your pages so you appear to Google as something else, dropping your SEO and meaning that people can click on your website, they go elsewhere costing you trade. Adding inaccurate data to your site ruining your reputation. Adding false payment gateways such as “pay your bill here”...

We have clients that have since been contacted by their insurance companies, wanting written confirmation that the clients’ websites have been patched. Insurance companies are also voiding aspects of cyber insurance if PHP2Shell has not been patched within a specified timeframe.

I’m on WordPress, not PHP

Nice try! WordPress runs on top of PHP. As does Joomla, Magento, Laravel, Drupal

How would I know if I’ve been hacked?

You may notice strange admin users, unexpected redirects in Google results, emails landing in junk, unfamiliar files, warnings from a host, bounced emails that you did not send, or nothing at all… you may not know as a backdoor could be sitting there dormant.

Is this going to happen more often?

Yes. To what degree, we do not know. But yes, for sure.

Who are they targeting?

There are some sectors being exploited first as they are easy pickings or gateways to more crucial services, but we need to assume everyone is a target.

Okay, what do I need to do?

In short, two things. Firstly, ensure your server is running a PHP2Shell patch, even though you may need to upgrade and migrate a few other bits to achieve this. Secondly, and this is to protect you more moving forward, is to get yourself on the latest versions of everything; update PHP, your operating system, your website files, everything. This means you’ll be a step ahead and have the best chance.

How do I know if I am patched?

WARNING – TECH LANGUAGE. Patched releases shipped on October 21: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. However, to complicate things, there are unofficial patches for certain older distributions which are harder to detect. Insurers will want to know whether CVE-2026-109618 and CVE-2026-109619 have been patched. If in doubt, ask.

I’ve patched, am I safe now?

Patching closes the hole, but if a hacker has been inside before the patch was applied, they may have left back doors. If your site was not taken offline before 3pm (UK time) on 21st October, it could be worth looking for ‘damage’, changing passwords and taking precautionary steps. If it was, it doesn’t 100% mean it is safe, but it is considerably more likely.

What if I don’t?

Aaron shrugs his shoulders. Hacks are going to increase. The next year or so is going to be crazy. Watch this space. Web hosts could turn your website off indefinitely, and without warning (after all, this is the government’s advice). If you get compromised, you need to report it to the ICO within 72 hours of being aware of it. You need to tell clients that their details have been leaked. You may have to tell them that payments have been taken, and you may be responsible. You need to explain why you didn’t take reasonable steps to secure them. You could drop from search engines. Your site could go offline. You could have a huge bill to secure things afterwards.

Can updating my security plugin or CMS fix this?

No, the vulnerability is at a much deeper level. Updating WordPress, Joomla or Magento for example will not close this vulnerability.

Whose job is it, my web host or my web developer?

Ah, this is an issue; it depends. The server is often the web host’s responsibility (but not always), and this is why many of them are updating PHP automatically. However, not all websites work on all versions of PHP, so a server update by a host could then stop a website working which you’ll need a developer for, and more than likely have to pay. Then you get out of date versions of PHP with no official patch; these likely fall into the ‘neither’ bracket. Remember that this is unprecedented. So yes, it really does depend.

Are you just scaremongering?

No. If you don’t believe me and want to bury your head in the sand like an ostrich, then fine. We have previously had company directors come to us in tears, saying that they have been compromised and can’t handle the fallout. You can lead a horse to water…

Why didn’t my web agency tell me my website was out of date and not secure?

In 25 years of business, we have never seen a client website get hacked through PHP. A third of the Internet uses out of date PHP with no security updates, and it was still deemed low risk as the methods needed to hack a website were difficult and long-winded. Updating PHP could break websites and cost site owners thousands of pounds. It’s a hard sell to ask someone to spend thousands of pounds to secure against something that is very unlikely to happen. That is until AI came along, and made the hacking a lot easier, and the code updates a lot cheaper. The balance has been shifted!

Will you write a letter to my insurer?

We can write a letter to your insurer as to whether CVE-2026-109618 and CVE-2026-109619 have been patched, or answer any other security questions they have. We will, however, need to do our investigations first to ensure that what we say is accurate. A letter can only say what we found at the time we checked, not confirm that a breach hasn’t taken place.

What is going to happen moving forward?

We expect more of the same, but it is anybody’s guess as to how frequent and how bad these exploits will be, or how costly they are to fix, or to ignore…

What did Webbed Feet do?

Turned all of our websites off before the 3pm deadline. Worked 24/7 through the night(s). Patched, tested, and got them back, mostly within 12 hours, the others following the next day.

What can Webbed Feet do for you?

• Audit – tell you where you are at, and what you need to do
• Patch – make sure your infrastructure is secure
• Update – update your code so that it runs on later versions
• Consult – advise, or be an expert that ‘has your back’
• Rectify - Should the worst happen, we can undo any damage

Woohoo, Webbed Feet

We are Webbed Feet, we are experts at Internet security

Interested? Get in touch